Sign locally-built paths

Locally-built paths are now signed automatically using the secret keys
specified by the ‘secret-key-files’ option.

1 files changed, 3 insertions, 0 deletions

diff --git a/src/libstore/build.cc b/src/libstore/build.cc
index 31c321c83a..1a51d0ec40 100644
--- a/src/libstore/build.cc
+++ b/src/libstore/build.cc
@@ -2748,6 +2748,7 @@ void DerivationGoal::registerOutputs()
                trusted. */
             if (!info.ultimate) {
                 info.ultimate = true;
+                worker.store.signPathInfo(info);
                 worker.store.registerValidPaths({info});
             }
 
@@ -2808,6 +2809,8 @@ void DerivationGoal::registerOutputs()
         info.references = references;
         info.deriver = drvPath;
         info.ultimate = true;
+        worker.store.signPathInfo(info);
+
         infos.push_back(info);
     }