---
name: SOLNIX-CACHE-OPERATOR
description: Understand and operate the Solnix signed binary cache and its reproducibility-trust model. Use when the task touches cache signing, submission, publication, durability classes, or the trust tally.
---

# The Solnix binary cache

A signed Nix binary cache at `https://cache.solnix.io`. One signing key, held by
the site; builders submit **unsigned** artifacts and the site classifies then
signs. See [trust-and-signing](community/steering/trust-and-signing.md).

## Signing (Option A — the site signs)

- The signer `cache.solnix.io-1:8UNrVAOSOrI9PGHc8/pD2Yqp265ZeYb3OId+gv4+wm8=`
  never leaves the cluster. Its private half is in sops.
- **Classify before sign**: an artifact is published only if it's installable.
  Rule of thumb: *"if it's not installable, remove it."*
- narinfo fingerprint signed: `1;<StorePath>;<NarHash>;<NarSize>;<refs>`.

## Submission flow

Builders upload to staging, then a controller promotes:
`POST /api/v1/cache/submit/begin` → upload → `.../finalize` → classify → sign →
publish. Status: `GET /api/v1/cache/submit/status/:id`.

## Durability classes (do not GC these)

Build **inputs/seeds/proto/toolchain/images** are a **protected durability
class**. They reference `/usr` by design and must never be deleted by
retire/GC, regardless of leaf-installability. Protected hashes/prefixes are
enforced before any deletion.

## Reproducibility as trust

A binary earns trust from **independent builders producing the same output
hash** (a quorum), not from who built it. The trust tier of a package
(`verified` / `reproduced` / `single` / `disputed`) is visible via
`GET /api/v1/packages/:attr/attestations`. See
[reproducibility-as-trust](community/steering/reproducibility-as-trust.md).

## Common operations

Purging the CDN edge, growing cache storage, rotating keys, and retiring broken
objects are documented in the infra runbooks (operator-only). The public
contract is: signed, reproducible, durable, honest about what's installable.