Skip to main content
In order to upload a package it must be signed, and in order to install a package published to a Flox Catalog you must configure your system to trust the public key used to sign the package. By default, packages published to FloxHub-hosted catalogs are signed with the floxhub-1 key, which ships with the Flox installer, so Flox is configured to be able to install user-published packages out of the box. If you installed Flox with Nix instead of the Flox installer — for example with nix profile install, or as part of a nix-darwin or NixOS configuration — your system doesn’t have the floxhub-1 key, and installing a package published to a FloxHub-hosted catalog fails with:
To fix this, add floxhub-1 to your Nix configuration’s trusted public keys, the same way you would trust any other public key. If you’re using a standalone Nix or Flox-installed Nix setup, add floxhub-1 to the extra-trusted-public-keys line in /etc/nix/nix.conf (append to an existing line rather than adding a second one):
Then restart the Nix daemon. If your system is managed by NixOS or nix-darwin, add it to nix.settings instead, then rebuild and switch into your configuration:
See the generic Nix install instructions for the full configuration examples, including the Flox binary cache key. However, if you’re providing your own Catalog Store, then you must
  • Create the signing keys
  • Distribute the private key to users trusted to publish packages
  • Distribute the public key to users allowed to install those packages
  • Have those users configure their systems to trust the public key

​
Create a signing key pair

Use the nix CLI to generate a private key:
Then generate a public key from the private key:

​
Sign packages to upload artifacts

Once you’ve generated the key, you can configure Flox to sign the packages you publish with that (private) key:
The path to the private key must be configured with an absolute path for security purposes.
If you need to use a different signing key (for example, to publish to a different catalog), you can use the --signing-private-key option with the flox publish command. The option takes precedence over publish.signing_private_key. The private key is necessary for uploading artifacts, so anyone that needs that capability will need access to the key. One solution is to put the key in a password manager and grant access to users that need to publish.

​
Trust a public key to install published artifacts

In order to install a published package you must configure your system to trust the corresponding public key that the artifact was signed with. This amounts to adding the public key to the list of extra-trusted-public-keys in your Nix configuration.

​
Add a new trusted key

​
Nix installed via Flox, or standalone Nix installation

If you installed Nix as part of your Flox installation, you need to edit your /etc/nix/nix.conf to add a new entry to the extra-trusted-public-keys option. If /etc/nix/nix.conf doesn’t exist, create it. If the extra-trusted-public-keys option doesn’t exist, create it. This option is a space-delimited list of trusted public keys. Add the following line, where <key contents> is the contents of the signing public key file and <existing keys> is any keys that were already populated for this option (if it existed):
Note that you do not need quotes around keys in the extra-trusted-public-keys option. In order for the newly trusted key to take effect, the Nix daemon needs to be restarted. On Linux the daemon is managed via systemd, so you can restart it with the following command:
On macOS the Nix daemon is managed via launchd, so you can restart it with the following command (note that you have to run the command twice, this is not a typo):

​
NixOS, nix-darwin, or home-manager

For systems whose configuration is managed with Nix, you need to add the public key to the list of trusted public keys in your system configuration. For NixOS, nix-darwin, and home-manager the configuration option is the same:
Once this setting has been edited, rebuild and switch into your new configuration.

​
Verify that the key is now trusted

Now verify that the daemon has been restarted and picked up the new key. You can do this by printing out the daemon’s current configuration, and searching for the key that you’ve just added: