Reference

nix3-store-verify(1)

verify the integrity of store paths

Warning
This program is experimental ⟨@docroot@/development/experimental-features.md#xp-feature-nix-command⟩ and its interface is subject to change.

Name

nix store verify - verify the integrity of store paths

Synopsis

nix store verify [option…] installables…

Examples

•

Verify the entire Nix store:

# nix store verify --all

•

Check whether each path in the closure of Firefox has at least 2 signatures:

# nix store verify --recursive --sigs-needed 2 --no-contents $(type -p firefox)

•

Verify a store path in the binary cache https://cache.nixos.org/:

# nix store verify --store https://cache.nixos.org/ \
  /nix/store/v5sv61sszx301i0x6xysaqzla09nksnd-hello-2.10

Description

This command verifies the integrity of the store paths installables ⟨./nix.md#installables⟩\c , or, if --all is given, the entire Nix store. For each path, it checks that

•

its contents match the NAR hash recorded in the Nix database; and

•

it is trusted, that is, it is signed by at least one trusted signing key, is content-addressed, or is built locally (“ultimately trusted”).

Exit status

The exit status of this command is the sum of the following values:

•

1 if any path is corrupted (i.e. its contents don’t match the recorded NAR hash).

•

2 if any path is untrusted.

•

4 if any path couldn’t be verified for any other reason (such as an I/O error).

Options

•

--no-contents ⟨#opt-no-contents⟩

Do not verify the contents of each store path.

•

--no-trust ⟨#opt-no-trust⟩

Do not verify whether each store path is trusted.

•

--sigs-needed ⟨#opt-sigs-needed⟩ / -n n

Require that each path is signed by at least n different keys.

•

--stdin ⟨#opt-stdin⟩

Read installables from the standard input. No default installable applied.

•

--substituter ⟨#opt-substituter⟩ / -s store-uri

Use signatures from the specified store.

Common evaluation options

•

--arg ⟨#opt-arg⟩ name expr

Pass the value expr as the argument name to Nix functions.

•

--arg-from-file ⟨#opt-arg-from-file⟩ name path

Pass the contents of file path as the argument name to Nix functions.

•

--arg-from-stdin ⟨#opt-arg-from-stdin⟩ name

Pass the contents of stdin as the argument name to Nix functions.

•

--argstr ⟨#opt-argstr⟩ name string

Pass the string string as the argument name to Nix functions.

•

--debugger ⟨#opt-debugger⟩

Start an interactive environment if evaluation fails.

•

--eval-store ⟨#opt-eval-store⟩ store-url

The URL of the Nix store ⟨@docroot@/store/types/index.md#store-url-format⟩ to use for evaluation, i.e. to store derivations (.drv files) and inputs referenced by them.

•

--impure ⟨#opt-impure⟩

Allow access to mutable paths and repositories.

•

--include ⟨#opt-include⟩ / -I path

Add path to search path entries used to resolve lookup paths ⟨@docroot@/language/constructs/lookup-path.md⟩

This option may be given multiple times.

Paths added through -I take precedence over the nix-path configuration setting ⟨@docroot@/command-ref/conf-file.md#conf-nix-path⟩ and the NIX_PATH environment variable ⟨@docroot@/command-ref/env-common.md#env-NIX_PATH⟩\c .

•

--override-flake ⟨#opt-override-flake⟩ original-ref resolved-ref

Override the flake registries, redirecting original-ref to resolved-ref.

Common flake-related options

•

--commit-lock-file ⟨#opt-commit-lock-file⟩

Commit changes to the flake’s lock file.

•

--inputs-from ⟨#opt-inputs-from⟩ flake-url

Use the inputs of the specified flake as registry entries.

•

--no-registries ⟨#opt-no-registries⟩

Don’t allow lookups in the flake registries.

DEPRECATED

Use --no-use-registries ⟨@docroot@/command-ref/conf-file.md#conf-use-registries⟩ instead.

•

--no-update-lock-file ⟨#opt-no-update-lock-file⟩

Do not allow any updates to the flake’s lock file.

•

--no-write-lock-file ⟨#opt-no-write-lock-file⟩

Do not write the flake’s newly generated lock file.

•

--output-lock-file ⟨#opt-output-lock-file⟩ flake-lock-path

Write the given lock file instead of flake.lock within the top-level flake.

•

--override-input ⟨#opt-override-input⟩ input-path flake-url

Override a specific flake input (e.g. dwarffs/nixpkgs). This implies --no-write-lock-file.

•

--recreate-lock-file ⟨#opt-recreate-lock-file⟩

Recreate the flake’s lock file from scratch.

DEPRECATED

Use nix flake update ⟨@docroot@/command-ref/new-cli/nix3-flake-update.md⟩ instead.

•

--reference-lock-file ⟨#opt-reference-lock-file⟩ flake-lock-path

Read the given lock file instead of flake.lock within the top-level flake.

•

--update-input ⟨#opt-update-input⟩ input-path

Update a specific flake input (ignoring its previous entry in the lock file).

DEPRECATED

Use nix flake update ⟨@docroot@/command-ref/new-cli/nix3-flake-update.md⟩ instead.

Logging-related options

•

--debug ⟨#opt-debug⟩

Set the logging verbosity level to ‘debug’.

•

--log-format ⟨#opt-log-format⟩ format

Set the format of log output; one of raw, internal-json, bar or bar-with-logs.

•

--print-build-logs ⟨#opt-print-build-logs⟩ / -L

Print full build logs on standard error.

•

--quiet ⟨#opt-quiet⟩

Decrease the logging verbosity level.

•

--verbose ⟨#opt-verbose⟩ / -v

Increase the logging verbosity level.

Miscellaneous global options

•

--help ⟨#opt-help⟩

Show usage information.

•

--offline ⟨#opt-offline⟩

Disable substituters and consider all previously downloaded files up-to-date.

•

--option ⟨#opt-option⟩ name value

Set the Nix configuration setting name to value (overriding nix.conf).

•

--refresh ⟨#opt-refresh⟩

Consider all previously downloaded files out-of-date.

•

--repair ⟨#opt-repair⟩

During evaluation, rewrite missing or corrupted files in the Nix store. During building, rebuild missing or corrupted store paths.

•

--version ⟨#opt-version⟩

Show version information.

Options that change the interpretation of installables

•

--all ⟨#opt-all⟩

Apply the operation to every store path.

•

--derivation ⟨#opt-derivation⟩

Operate on the store derivation ⟨@docroot@/glossary.md#gloss-store-derivation⟩ rather than its outputs.

•

--expr ⟨#opt-expr⟩ expr

Interpret installables ⟨@docroot@/command-ref/new-cli/nix.md#installables⟩ as attribute paths relative to the Nix expression expr.

•

--file ⟨#opt-file⟩ / -f file

Interpret installables ⟨@docroot@/command-ref/new-cli/nix.md#installables⟩ as attribute paths relative to the Nix expression stored in file. If file is the character -, then a Nix expression will be read from standard input. Implies --impure.

•

--recursive ⟨#opt-recursive⟩ / -r

Apply operation to closure of the specified paths.

Note

See man nix.conf ⟨@docroot@/command-ref/conf-file.md#command-line-flags⟩ for overriding configuration settings with command line flags.

History