.\" -*- mode: troff; coding: utf-8 -*-
.TH "nix3-key-generate-secret" "1" ""
.PP
\fBWarning\fR: This program is \fBexperimental\fR and its interface is subject to change.
.SH Name
\fCnix key generate-secret\fR - generate a secret key for signing store paths
.SH Synopsis
\fCnix key generate-secret\fR [\fIoption\fR\[u2026]] 
.SH Examples
.IP "\(bu" 2
Generate a new secret key:
.LP
.EX
# nix key generate-secret --key-name cache.example.org-1 > ./secret-key
.EE
.IP
We can then use this key to sign the closure of the Hello package:
.LP
.EX
# nix build nixpkgs#hello
# nix store sign --key-file ./secret-key --recursive ./result
.EE
.IP
Finally, we can verify the store paths using the corresponding
public key:
.LP
.EX
# nix store verify --trusted-public-keys $(nix key convert-secret-to-public < ./secret-key) ./result
.EE
.SH Description
This command generates a new Ed25519 secret key for signing store
paths and prints it on standard output. Use \fCnix key
convert-secret-to-public\fR to get the corresponding public key for
verifying signed store paths.
.PP
The mandatory argument \fC--key-name\fR specifies a key name (such as
\fCcache.example.org-1). It is used to look up keys on the client when
it verifies signatures. It can be anything, but it’s suggested to use
the host name of your cache (e.g.\fRcache.example.org\(ga) with a suffix
denoting the number of the key (to be incremented every time you need
to revoke a key).
.SH Format
Both secret and public keys are represented as the key name followed
by a base-64 encoding of the Ed25519 key data, e.g.
.LP
.EX
cache.example.org-0:E7lAO+MsPwTFfPXsdPtW8GKui/5ho4KQHVcAGnX+Tti1V4dUxoVoqLyWJ4YESuZJwQ67GVIksDt47og+tPVUZw==
.EE
.SH Options
.IP "\(bu" 2
\fC--key-name\fR \fIname\fR
.br
Identifier of the key (e.g. \fCcache.example.org-1\fR).