Warning
This program is
experimental
and its interface is subject to change.
nix store verify - verify the integrity of
store paths
nix store verify [option…]
installables…
- •
- Verify the entire Nix store:
# nix store verify --all
- •
- Check whether each path in the closure of Firefox has at least 2
signatures:
# nix store verify --recursive --sigs-needed 2 --no-contents $(type -p firefox)
- •
- Verify a store path in the binary cache
https://cache.nixos.org/:
# nix store verify --store https://cache.nixos.org/ \
/nix/store/v5sv61sszx301i0x6xysaqzla09nksnd-hello-2.10
This command verifies the integrity of the store paths
installables, or, if
--all is given, the entire Nix store. For each path,
it checks that
- its contents match the NAR hash recorded in the Nix database; and
- it is trusted, that is, it is signed by at least one trusted
signing key, is content-addressed, or is built locally (“ultimately
trusted”).
The exit status of this command is the sum of the following
values:
- 1 if any path is corrupted (i.e. its contents don’t match
the recorded NAR hash).
- 2 if any path is untrusted.
- 4 if any path couldn’t be verified for any other reason
(such as an I/O error).
- •
- --no-contents
- Do not verify the contents of each store path.
- •
- --no-trust
- Do not verify whether each store path is trusted.
- •
- --sigs-needed
/ -n n
- Require that each path is signed by at least n different keys.
- •
- --stdin
- Read installables from the standard input. No default installable
applied.
- •
- --substituter
/ -s store-uri
- Use signatures from the specified store.
- •
- --arg
name expr
- Pass the value expr as the argument name to Nix
functions.
- •
- --arg-from-file
name path
- Pass the contents of file path as the argument name to Nix
functions.
- •
- --arg-from-stdin
name
- Pass the contents of stdin as the argument name to Nix
functions.
- •
- --argstr
name string
- Pass the string string as the argument name to Nix
functions.
- •
- --debugger
- Start an interactive environment if evaluation fails.
- •
- --eval-store
store-url
- The
URL
of the Nix store to use for evaluation, i.e. to store derivations
(.drv files) and inputs referenced by them.
- •
- --impure
- Allow access to mutable paths and repositories.
- •
- --include /
-I path
- Add path to search path entries used to resolve
lookup
paths
- This option may be given multiple times.
- Paths added through -I take precedence over the
nix-path
configuration setting and the
NIX_PATH
environment variable.
- •
- --override-flake
original-ref resolved-ref
- Override the flake registries, redirecting original-ref to
resolved-ref.
- •
- --commit-lock-file
- Commit changes to the flake’s lock file.
- •
- --inputs-from
flake-url
- Use the inputs of the specified flake as registry entries.
- •
- --no-registries
- Don’t allow lookups in the flake registries.
- •
- --no-update-lock-file
- Do not allow any updates to the flake’s lock file.
- •
- --no-write-lock-file
- Do not write the flake’s newly generated lock file.
- •
- --output-lock-file
flake-lock-path
- Write the given lock file instead of flake.lock
within the top-level flake.
- •
- --override-input
input-path flake-url
- Override a specific flake input (e.g.
dwarffs/nixpkgs). This implies
--no-write-lock-file.
- •
- --recreate-lock-file
- Recreate the flake’s lock file from scratch.
- •
- --reference-lock-file
flake-lock-path
- Read the given lock file instead of flake.lock
within the top-level flake.
- •
- --update-input
input-path
- Update a specific flake input (ignoring its previous entry in the lock
file).
- •
- --debug
- Set the logging verbosity level to ‘debug’.
- •
- --log-format
format
- Set the format of log output; one of raw,
internal-json, bar or
bar-with-logs.
- •
- --print-build-logs
/ -L
- Print full build logs on standard error.
- •
- --quiet
- Decrease the logging verbosity level.
- •
- --verbose /
-v
- Increase the logging verbosity level.
- •
- --help
- Show usage information.
- •
- --offline
- Disable substituters and consider all previously downloaded files
up-to-date.
- •
- --option
name value
- Set the Nix configuration setting name to value (overriding
nix.conf).
- •
- --refresh
- Consider all previously downloaded files out-of-date.
- •
- --repair
- During evaluation, rewrite missing or corrupted files in the Nix store.
During building, rebuild missing or corrupted store paths.
- •
- --version
- Show version information.
- •
- --all
- Apply the operation to every store path.
- •
- --derivation
- Operate on the
store
derivation rather than its outputs.
- •
- --expr
expr
- Interpret
installables
as attribute paths relative to the Nix expression expr.
- •
- --file /
-f file
- Interpret
installables
as attribute paths relative to the Nix expression stored in file.
If file is the character -, then a Nix expression will be read from
standard input. Implies --impure.
- •
- --recursive
/ -r
- Apply operation to closure of the specified paths.
Note
See
man
nix.conf for overriding configuration settings with command line
flags.