| 27 Jun 2026 |
 hexa | eval is running https://staging-hydra.nixos.org/jobset/nixos/unstable-small | 11:29:00 |
 eyJhb | @[hexa (signing key rotation when)] how big of a hassle would it be to change the signing keys? | 11:30:42 |
| hexa | not super big | 11:31:04 |
| hexa | requires some testing | 11:31:11 |
| hexa | rolling a new key | 11:31:14 |
| hexa | ideally the new key is pq safe | 11:31:25 |
| hexa | make nixpkgs adopt the new key in addition to the old key | 11:31:51 |
| hexa | set a retire date for the old key, or don't | 11:32:03 |
| hexa | but at some point it should be removed from default trust in nixpkgs/nixos | 11:33:18 |
| hexa | Redacted or Malformed Event | 11:33:21 |
| hexa | we can enumerate the number of people who could've pulled the old signing key off hydra.nixos.org | 11:34:05 |
| hexa | and it is probably a high single digit or low double digit number | 11:34:33 |
| hexa | still no good way to put it into a secure enclave | 11:34:54 |
| hexa | though I'm sure the foundation would grant funding for such a project | 11:35:08 |
| hexa | it doesn't look like nix is bottlenecking on that branch | 11:36:57 |
| hexa | # curl -s localhost:8080/metrics | grep hydraqueuerunner_machine_type_runnable
# HELP hydraqueuerunner_machine_type_runnable Number of runnable build steps per machine type
# TYPE hydraqueuerunner_machine_type_runnable gauge
hydraqueuerunner_machine_type_runnable{machine_type="aarch64-darwin"} 0
hydraqueuerunner_machine_type_runnable{machine_type="aarch64-linux"} 825
hydraqueuerunner_machine_type_runnable{machine_type="builtin"} 0
hydraqueuerunner_machine_type_runnable{machine_type="i686-linux"} 0
hydraqueuerunner_machine_type_runnable{machine_type="x86_64-darwin"} 0
hydraqueuerunner_machine_type_runnable{machine_type="x86_64-linux"} 876
hydraqueuerunner_machine_type_runnable{machine_type="x86_64-v1-linux"} 0
hydraqueuerunner_machine_type_runnable{machine_type="x86_64-v2-linux"} 0
hydraqueuerunner_machine_type_runnable{machine_type="x86_64-v3-linux"} 0
| 11:38:33 |
| hexa | Redacted or Malformed Event | 11:38:45 |
| hexa | that looks sensible | 11:38:48 |
| eyJhb | That was also my theory, thanks for explaining it :) Would be nice if they were rotated, but I wonder how much hassle it would cause some weird edge-case people made. But worst cause, I assume they could just have all the old signing keys :) | 11:42:55 |
| hexa | Mic92 lgtm, do you want to double-check? | 11:53:51 |
 emily | am working on something that would be very helpful for this fwiw | 11:57:59 |
| emily | though I think it would probably be good to just do a "simple" swap first to get into the habit/build processes | 11:58:20 |
| emily | ideally we'd be rotating every year or so | 11:58:29 |
| hexa | applying to mimas | 11:58:31 |
| emily | transparency logging too | 11:58:48 |
| hexa | you want it all | 11:59:13 |
| hexa | do you also want certificates instead of pubkeys? | 11:59:23 |
| emily | no, PKI sucks :) | 11:59:36 |
| hexa | ah, so this is where you draw the line, interesting :p | 11:59:49 |
| emily | though builder attestation yes | 11:59:58 |
