3 ms·
There has been a controversy around the server cache.nixos.org. The signing ed25519 cache key is from the year 2015 and there is no plan to rotate the key. It i
by nixer6872 3y ago
There has been a controversy around the server cache.nixos.org. The signing ed25519 cache key is from the year 2015 and there is no plan to rotate the key. It is apparent that a key cannot hold for all these years.
I have been made aware of the matter when somebody on the matrix claimed that there is no plan to rotate the cache key. He/She said reasons behind that are explained by Eelco D. in https://www.youtube.com/watch?v=yXPQdZh8o7c https://www.youtube.com/watch?v=yXPQdZh8o7c. Unfortunately, I couldn't confirm this. That person afterwards claimed that the video is cut and that part was removed intentionally.
If that's the case, it might be the reason why ppl stop paying for the cache server costs. Furthermore, if the foundation attempted to hide the facts by cutting the video and re-uploading, for me, this is a matter of dishonesty and somebody should take the responsibility for it. I believe this person is Ron E., the current director of the Nixos Foundation. But in any case, this claim should be backed by finding the original stream of the Nix 20th Community Panel recording.
For the rest of us, until some cryptogeek fixes nix to support certs and key lifecycles, the solution is to build a local cache with hydra and flakes. There are many ppl keen on the subject, you can look for one on the matrix.