# Steering: trust and signing

How Solnix decides a binary is safe to serve.

- **One signer, held by the site.** `cache.solnix.io-1:8UNrVAOSOrI9PGHc8/pD2Yqp265ZeYb3OId+gv4+wm8=`.
  The private half never leaves the cluster. Builders submit **unsigned**.
- **Classify, then sign.** The site decides whether an artifact is installable
  before signing it. The rule: *if it's not installable, remove it* — don't sign
  junk into the trusted set.
- **The fingerprint signed** is `1;<StorePath>;<NarHash>;<NarSize>;<refs>`.
- **Trust comes from reproduction, not authorship** — see
  `reproducibility-as-trust`. The signer is the *gatekeeper*; the *reason* to
  trust is independent identical hashes.
- **Protected durability class.** Build inputs, seeds, proto, toolchain, and
  images are never deleted by retire/GC and are never judged by the
  leaf-installability gate — they legitimately reference `/usr`.
- **Key lifecycle.** Committer keys live until revoked, with optional self-set
  expiry, tracked in `registry.committer_keys`. Some regions can require
  `sign-with-two`.

For agents: verify the public key before trusting the cache; prefer
`verified`/`reproduced` packages; a `disputed` tier means independent builders
got different hashes — do not trust it blindly.