NixCI Cache

This is a binary cache for Nix. It stores pre-built store paths so that builds can be reused instead of repeated.

Signing key

To use the cache, add this key to your trusted-public-keys so that your Nix will accept the paths it fetches.

nix-ci:g3xV5BDTLtIBZr/A00IU1x0EtKKlb7YLgBN2SgYgM6A=

Trusting this key means your Nix will substitute any store path this cache serves to you, using that path's contents instead of building it locally. The signature only attests that a path came through this cache. It does not attest how the path was built, or by whom. So you are trusting this cache itself: its operator, and the integrity of everything it has been given to serve.

How a trusted key can be abused

A key that you trust using trusted-public-keys lets its secret-key holders substitute anything your Nix fetches from this cache. Here is how a secret-key holder could abuse your trust, step by step:

  1. You add someone's public key to your trusted-public-keys so that you can reuse their builds.
  2. They choose a package you depend on, say the openssl package, and build a backdoored version of it. Its store path does not change, because the path is derived from the build inputs, but its contents now do whatever they like.
  3. They sign that store path together with its malicious contents using their key, and upload it to any cache you read from.
  4. Your next build needs the openssl package. Nix asks the cache for that store path, gets their .narinfo carrying a signature you trust, and substitutes their backdoored build instead of building openssl itself.
  5. Their code now runs in your build, and in everything you deploy from it.

Access control bounds who can reach you this way. This cache only serves you paths under owners you are allowed to read, and a poisoned path can only get there if someone who may write to one of those owners uploaded it. A NixCI user therefore cannot poison your cache just by having an account; they would have to be able to write to an owner you read from.

Paths that are content-addressed are the exception: Nix checks them against their own hash, so they are safe to fetch without trusting anyone.

Authentication and access

This cache authenticates you through NixCI, which also decides which owners you may read from and write to. See the documentation for how authentication and access work, which owners exist, and which ones you and your builds can reach.