staging-hydra: sign paths with multiple keys

[picnoir]

POC for NixOS/rfcs#149

[picnoir]

Deployed on hydra staging.

[picnoir]

Hmm,

[nix-shell:/run/keys]# aws s3 cp "s3://nix-cache-staging/8zfb1mjcw0bfx72nkhmm7s1rzcd3769a.narinfo" /tmp/narinfo.narinfo && cat /tmp/narinfo.narinfo 
download: s3://nix-cache-staging/8zfb1mjcw0bfx72nkhmm7s1rzcd3769a.narinfo to ../../tmp/narinfo.narinfo
StorePath: /nix/store/8zfb1mjcw0bfx72nkhmm7s1rzcd3769a-bash-5.1-p8-dev
URL: nar/0mdahm77gr568608nzf34680bbws18m1dyfb81krsxzld5a0vqg1.nar.xz
Compression: xz
FileHash: sha256:0mdahm77gr568608nzf34680bbws18m1dyfb81krsxzld5a0vqg1
FileSize: 58100
NarHash: sha256:02qpw8z5vfy12kw6l0rhq4ys7cia5p3iwvhx4fx7cy7vxgs42xw1
NarSize: 309320
References: 8zfb1mjcw0bfx72nkhmm7s1rzcd3769a-bash-5.1-p8-dev jaiay49bnh3j9vmqzdfbz4x7nal3ab8m-bash-5.1-p8
Deriver: 1xdq21lhvc0yf5pqmc5pbrl1cq5z2vsh-bash-5.1-p8.drv
Sig: cache.nixos.org-1:dTc+wRjLVXbUfRg83B+Bja2rpQ/woHRnJu1nJOKGmu9FGbLJrr1Z9NuKqFlsgb4zOssJuGdVjEAFKcgK/yUfBw==
Sig: staging-hydra.nixos.org:A/tVGOQGpetF2O4MV+cRuhE5UknXgJ9pHGF2ATdiumGccjrVVFnD/ijT3/2vPeU0CpmqILFZvMhPoLlFNl3iCw==

It does not seem to work. There should be a second signature. :/

I need to investigate this further.

[picnoir]

Ah! Makes sense, NixOS/nix#12976 landed for Nix 2.29. Current hydra staging is on 2.28.

[mweinelt]

Nix upgrade is scheduled to happen after https://discourse.nixos.org/t/pre-disclosure-announcement-security-advisory-for-hydra-on-august-12-2025/67615/6.