Security

Email us privately

Send security reports to security@solnix.io. Please do not open a public issue for a security bug — email first so we can fix it before it's disclosed.

Include enough to reproduce: affected component (cache, site, a package, a module), version or store path if known, and the impact you observed. A proof-of-concept helps but isn't required. If you want to encrypt, say so in a first low-detail message and we'll arrange a key.

What to expect

• Acknowledgement within 3 business days. We're a small project — if you don't hear back, ping greg@solnix.io.
• An initial assessment (is it real, how bad, who's affected) within ~10 business days.
• A fix or mitigation timeline once we've triaged. We'll keep you updated rather than go quiet.

These are targets, not contractual SLAs. We'll be honest if something is going to take longer.

We follow coordinated disclosure. Report privately; we investigate and fix; we publish once a fix or mitigation is available. The default embargo is up to 90 days from report, shortened when a fix ships sooner and extendable by mutual agreement if a fix is genuinely hard.

We'll credit reporters who want credit (and respect those who don't). We have no bug-bounty program yet — this is an early, unfunded project — but we take reports seriously and will acknowledge your work publicly when the issue is disclosed.

Testing rules: no attacks against the live cache, search, or site that degrade service for others (no DoS, no automated scanning that hammers the endpoints). Only test against infrastructure you control or with our prior agreement.

The cache signing key

Every store path served from cache.solnix.io is signed with an Ed25519 key. Nix verifies that signature before it trusts a substituted binary, so a path only installs if it was signed by the key below and its contents hash matches. Add the public key to your trusted keys and Nix does the rest:

# /etc/nix/nix.conf
substituters = https://cache.solnix.io https://cache.nixos.org
trusted-public-keys = cache.solnix.io-1:8UNrVAOSOrI9PGHc8/pD2Yqp265ZeYb3OId+gv4+wm8=

The private half is held offline by the maintainer and is never on a build or serving host. Compromise of the cache host alone does not let an attacker sign paths. Full setup is in the binary cache chapter.

If the key ever rotates

If we ever need to rotate the signing key — routine hygiene, or in response to a suspected compromise — the new key will be numbered (cache.solnix.io-2:…), so old and new can coexist during the transition and you can trust both keys while paths are re-signed.

This page and /.well-known/security.txt are the canonical record of the current key(s). When in doubt, compare the fingerprint above against what your nix.conf trusts.