`nix copy` should warn early if you forgot `--no-check-sigs` #1002

New issue

Open

opened 2025-10-03 19:12:38 +00:00 by vriska · 1 comment

vriska commented

2025-10-03 19:12:38 +00:00

Member

If nix copy is missing --no-check-sigs, this is only apparent at the end of copying. This is very frustrating when copying large closures.

Describe the solution you'd like

Ideally, it would fail early as soon as it tries to copy an untrusted derivation.

Describe alternatives you've considered

An alternative that would likely be easier to implement would be to warn if the path being copied doesn't have any signatures on the source.

## Is your feature request related to a problem? Please describe. If `nix copy` is missing `--no-check-sigs`, this is only apparent at the end of copying. This is very frustrating when copying large closures. ## Describe the solution you'd like Ideally, it would fail early as soon as it tries to copy an untrusted derivation. ## Describe alternatives you've considered An alternative that would likely be easier to implement would be to warn if the path being copied doesn't have any signatures on the source.

👍 1

lunaphied self-assigned this

2025-10-26 08:24:01 +00:00

lunaphied added the

labels

2025-10-26 08:25:09 +00:00

raito added the

release-blocker

label

2025-11-17 22:51:22 +00:00

raito commented

2025-11-30 16:05:59 +00:00

Owner

I looked into this and this is not obvious to me what could we do here.

In general, checking signature can only happen quite late because of all the asyncness, as soon as we find one and you did not pass --keep-going, we will cancel the transfer.

The best that can happen is either to warn on unsigned derivations (why just unsigned?) or throw on unsigned derivations.

I need to think more on this.

I looked into this and this is not obvious to me what could we do here. In general, checking signature can only happen quite late because of all the asyncness, as soon as we find one and you did not pass --keep-going, we will cancel the transfer. The best that can happen is either to warn on **unsigned** derivations (why just unsigned?) or throw on **unsigned** derivations. I need to think more on this.