From 3390c1be76f648ac0b18199c6204a32d1d6d5fbb Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Tue, 20 Feb 2007 22:57:46 +0000 Subject: [PATCH] * Temporary notes on how we're going to use OpenSSL. --- doc/signing.txt | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 doc/signing.txt diff --git a/doc/signing.txt b/doc/signing.txt new file mode 100644 index 000000000..fad14d743 --- /dev/null +++ b/doc/signing.txt @@ -0,0 +1,24 @@ +Generate a private key: + +$ openssl genrsa -out mykey.sec 2048 + +The private key should be kept secret (only readable to the Nix daemon +user). + + +Generate the corresponding public key: + +$ openssl rsa -in mykey.sec -pubout > mykey.pub + +The public key should be copied to all machines to which you want to +export store paths. + + +Signing: + +$ nix-hash --type sha256 --flat svn.nar | openssl rsautl -sign -inkey mykey.sec > svn.nar.sign + + +Verifying a signature: + +$ test "$(nix-hash --type sha256 --flat svn.nar)" = "$(openssl rsautl -verify -inkey mykey.pub -pubin -in svn.nar.sign)"