git.delta.rocks / jrsonnet / refs/commits / 53dc93b160c1

--- a/cmds/fleet/src/cmds/build_systems.rs
+++ b/cmds/fleet/src/cmds/build_systems.rs
@@ -191,6 +191,7 @@
 	// TODO: If rollback target exists - bail, it should be removed. Lockfile will not work in case if rollback
 	// is scheduler on next boot (default behavior). On current boot - rollback activator will fail due to
 	// unit name conflict in systemd-run
+	// This code is tied to rollback.nix
 	if !build.disable_rollback {
 		let _span = info_span!("preparing").entered();
 		info!("preparing for rollback");
@@ -334,6 +335,19 @@
 			Action::Upload { action } => {
 				if !config.is_local(&host) {
 					info!("uploading system closure");
+					{
+						let mut sign = MyCommand::new("sudo");
+						// Private key for host machine is registered in nix-sign.nix
+						sign.arg("nix")
+							.arg("store")
+							.arg("sign")
+							.comparg("-k", "/etc/nix/private-key")
+							.arg("-r")
+							.arg(&built);
+						if let Err(e) = sign.run_nix().await {
+							warn!("Failed to sign store paths: {e}");
+						};
+					}
 					let mut tries = 0;
 					loop {
 						let mut nix = MyCommand::new("nix");

--- a/cmds/fleet/src/command.rs
+++ b/cmds/fleet/src/command.rs
@@ -269,7 +269,7 @@
 								drv = pkg;
 							}
 						}
-						info!(target: "nix","copying {} {} -> {}", drv, from, to);
+						// info!(target: "nix","copying {} {} -> {}", drv, from, to);
 						let span = info_span!("copy", from, to, drv);
 						span.pb_start();
 						self.spans.insert(id, span);

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -3,4 +3,5 @@
   ../meta.nix
   ../secrets.nix
   ../rollback.nix
+  ../nix-sign.nix
 ]

--- a/nixos/rollback.nix
+++ b/nixos/rollback.nix
@@ -1,3 +1,4 @@
+# Tied to build_systems.rs
 {config, ...}: {
   # TODO: Make it work with systemd-initrd approach.
   # In this case we can't just switch generation and re-run activation script, since the root filesystem might not be