trusted-public-keys in a (trusted) user's nix.conf is silently ignored

[LnL7]

Configuring trusted-public-keys in ~/.config/nix/nix.conf gets silently ignored, resulting in a confusing error like this.

these paths will be fetched (0.34 MiB download, 1.80 MiB unpacked):
  /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-hello-2.10
warning: substituter 'https://cache.nix.example.org' does not have a valid signature for path '/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-hello-2.10'
error: build of '/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-hello-2.10.drv' failed

[dtzWill]

TIL you can have a per-user nix.conf! Neat.

[dtzWill]

This does appear to work on a single-user install, FWIW.

[LnL7]

Yes, from looking at the code seems to indicate trusted keys are only loaded when the daemon starts, so any changes afterwards sent by the client don't get applied.

Not allowing this is fine by me, but then the user should get an error when sending trusted keys to the daemon.

[domenkozar]

I don't quite understand what's the security model here though. If user wants to user a binary cache for himself/herself, how is that different than building the package from source? OK, the binary cache might be malicious, but user can also build malicious Nix files.

I do understand that user A shouldn't be able to whitelist binary caches for user B.

[edolstra]

Because the user can use a malicious binary cache to substitute a trojaned binary for a legitimate Nix expression, which could then be used by other users. E.g.

• Alice builds nixpkgs.firefox with a malicious binary cache that substitutes a Trojan for /nix/store/<X>-firefox.

• Bob later installs nixpkgs.firefox (i.e. the same, non-malicious derivation). Nix sees that /nix/store/<X>-firefox is already valid, so it has nothing to do. Bob runs Alice's Trojaned binary.

but user can also build malicious Nix files

But Alice cannot use that to hack Bob, she would have to get him to use her malicious Nix expression first.

However, this issue is about trusted users, who should have the ability to set trusted keys.

[domenkozar]

@edolstra ah, good one. Thank you.

[LnL7]

Yeah this is specifically for trusted users. I'm not sure but I think regular users get a warning that they are not allowed to set options like this.