--- name: "nix3-store-sign" section: "1" platform: "linux" package: "nix-bin" version: "2.26.3+dfsg-1" release: "Debian 13 (Trixie)" platforms: ["linux"] url: "https://new.carta.tech/nix3-store-sign" --- # nix3-store-sign(1) sign store paths with a local key **Warning** \ This program is **experimental** ⟨@docroot@/development/experimental-features.md#xp-feature-nix-command⟩ and its interface is subject to change. ## Name `nix store sign` - sign store paths with a local key ## Synopsis `nix store sign` \[*option*…\] *installables*… ## Options - • `--key-file` ⟨#opt-key-file⟩ / `-k` *file* - File containing the secret signing key. - • `--stdin` ⟨#opt-stdin⟩ - Read installables from the standard input. No default installable applied. ### Common evaluation options - • `--arg` ⟨#opt-arg⟩ *name* *expr* - Pass the value *expr* as the argument *name* to Nix functions. - • `--arg-from-file` ⟨#opt-arg-from-file⟩ *name* *path* - Pass the contents of file *path* as the argument *name* to Nix functions. - • `--arg-from-stdin` ⟨#opt-arg-from-stdin⟩ *name* - Pass the contents of stdin as the argument *name* to Nix functions. - • `--argstr` ⟨#opt-argstr⟩ *name* *string* - Pass the string *string* as the argument *name* to Nix functions. - • `--debugger` ⟨#opt-debugger⟩ - Start an interactive environment if evaluation fails. - • `--eval-store` ⟨#opt-eval-store⟩ *store-url* - The URL of the Nix store ⟨@docroot@/store/types/index.md#store-url-format⟩ to use for evaluation, i.e. to store derivations (`.drv` files) and inputs referenced by them. - • `--impure` ⟨#opt-impure⟩ - Allow access to mutable paths and repositories. - • `--include` ⟨#opt-include⟩ / `-I` *path* - Add *path* to search path entries used to resolve lookup paths ⟨@docroot@/language/constructs/lookup-path.md⟩ - This option may be given multiple times. - Paths added through `-I` take precedence over the `nix-path` configuration setting ⟨@docroot@/command-ref/conf-file.md#conf-nix-path⟩ and the `NIX_PATH` environment variable ⟨@docroot@/command-ref/env-common.md#env-NIX\_PATH⟩\\c . - • `--override-flake` ⟨#opt-override-flake⟩ *original-ref* *resolved-ref* - Override the flake registries, redirecting *original-ref* to *resolved-ref*. ### Common flake-related options - • `--commit-lock-file` ⟨#opt-commit-lock-file⟩ - Commit changes to the flake’s lock file. - • `--inputs-from` ⟨#opt-inputs-from⟩ *flake-url* - Use the inputs of the specified flake as registry entries. - • `--no-registries` ⟨#opt-no-registries⟩ - Don’t allow lookups in the flake registries. - **DEPRECATED** - Use `--no-use-registries` ⟨@docroot@/command-ref/conf-file.md#conf-use-registries⟩ instead. - • `--no-update-lock-file` ⟨#opt-no-update-lock-file⟩ - Do not allow any updates to the flake’s lock file. - • `--no-write-lock-file` ⟨#opt-no-write-lock-file⟩ - Do not write the flake’s newly generated lock file. - • `--output-lock-file` ⟨#opt-output-lock-file⟩ *flake-lock-path* - Write the given lock file instead of `flake.lock` within the top-level flake. - • `--override-input` ⟨#opt-override-input⟩ *input-path* *flake-url* - Override a specific flake input (e.g. `dwarffs/nixpkgs`). This implies `--no-write-lock-file`. - • `--recreate-lock-file` ⟨#opt-recreate-lock-file⟩ - Recreate the flake’s lock file from scratch. - **DEPRECATED** - Use `nix flake update` ⟨@docroot@/command-ref/new-cli/nix3-flake-update.md⟩ instead. - • `--reference-lock-file` ⟨#opt-reference-lock-file⟩ *flake-lock-path* - Read the given lock file instead of `flake.lock` within the top-level flake. - • `--update-input` ⟨#opt-update-input⟩ *input-path* - Update a specific flake input (ignoring its previous entry in the lock file). - **DEPRECATED** - Use `nix flake update` ⟨@docroot@/command-ref/new-cli/nix3-flake-update.md⟩ instead. ### Logging-related options - • `--debug` ⟨#opt-debug⟩ - Set the logging verbosity level to ‘debug’. - • `--log-format` ⟨#opt-log-format⟩ *format* - Set the format of log output; one of `raw`, `internal-json`, `bar` or `bar-with-logs`. - • `--print-build-logs` ⟨#opt-print-build-logs⟩ / `-L` - Print full build logs on standard error. - • `--quiet` ⟨#opt-quiet⟩ - Decrease the logging verbosity level. - • `--verbose` ⟨#opt-verbose⟩ / `-v` - Increase the logging verbosity level. ### Miscellaneous global options - • `--help` ⟨#opt-help⟩ - Show usage information. - • `--offline` ⟨#opt-offline⟩ - Disable substituters and consider all previously downloaded files up-to-date. - • `--option` ⟨#opt-option⟩ *name* *value* - Set the Nix configuration setting *name* to *value* (overriding `nix.conf`). - • `--refresh` ⟨#opt-refresh⟩ - Consider all previously downloaded files out-of-date. - • `--repair` ⟨#opt-repair⟩ - During evaluation, rewrite missing or corrupted files in the Nix store. During building, rebuild missing or corrupted store paths. - • `--version` ⟨#opt-version⟩ - Show version information. ### Options that change the interpretation of **installables** - • `--all` ⟨#opt-all⟩ - Apply the operation to every store path. - • `--derivation` ⟨#opt-derivation⟩ - Operate on the store derivation ⟨@docroot@/glossary.md#gloss-store-derivation⟩ rather than its outputs. - • `--expr` ⟨#opt-expr⟩ *expr* - Interpret *installables* ⟨@docroot@/command-ref/new-cli/nix.md#installables⟩ as attribute paths relative to the Nix expression *expr*. - • `--file` ⟨#opt-file⟩ / `-f` *file* - Interpret *installables* ⟨@docroot@/command-ref/new-cli/nix.md#installables⟩ as attribute paths relative to the Nix expression stored in *file*. If *file* is the character -, then a Nix expression will be read from standard input. Implies `--impure`. - • `--recursive` ⟨#opt-recursive⟩ / `-r` - Apply operation to closure of the specified paths. **Note** See `man nix.conf` ⟨@docroot@/command-ref/conf-file.md#command-line-flags⟩ for overriding configuration settings with command line flags.