fix: use extra-substituters to avoid untrusted user warnings by shunkakinoki · Pull Request #1351 · shunkakinoki/dotfiles

shunkakinoki · 2026-04-04T14:21:52Z

Summary

Replace substituters / trusted-public-keys with extra-substituters / extra-trusted-public-keys in Home Manager nix settings
Remove use-xdg-base-directories (restricted setting not allowed for untrusted users)
Remove redundant cache.nixos.org entry (already in default substituters)

Fixes the repeated "ignoring untrusted substituter" and "ignoring the client-specified setting" warnings during make build && make switch.

The extra- prefixed settings are not restricted, so they work for non-trusted users in standalone Home Manager setups (kyber).

Summary by cubic

Switch Home Manager Nix config to extra-substituters/extra-trusted-public-keys and remove restricted options to stop “untrusted substituter” and “ignoring the client-specified setting” warnings for non‑trusted users during build/switch. Removed use-xdg-base-directories (restricted) and the redundant cache.nixos.org entry since it’s included by default.

^{Written for commit 2536bdd. Summary will update on new commits.}

mesa-dot-dev · 2026-04-04T14:21:56Z

You do not have enough credits to review this pull request. Please purchase more credits to continue.

coderabbitai · 2026-04-04T14:22:04Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ecffcd3d-8d7b-47af-94f9-9cc1fcfe455c

📥 Commits

Reviewing files that changed from the base of the PR and between 34dacb6 and 2536bdd.

📒 Files selected for processing (1)

home-manager/nix/nix.nix

📝 Walkthrough

Summary by CodeRabbit

Chores
- Updated Nix cache configuration format to use extended settings for custom cache endpoints and trust keys.
- Removed default NixOS cache from base configuration while preserving alternative cache providers.

Walkthrough

Updated Nix cache configuration by removing the standard https://cache.nixos.org endpoint and its trust key, transitioning alternative cache endpoints to use extra-substituters and extra-trusted-public-keys settings. Dropped explicit use-xdg-base-directories configuration.

Changes

Cohort / File(s)	Summary
Nix Cache Configuration `home-manager/nix/nix.nix`	Replaced standard `substituters`/`trusted-public-keys` with `extra-substituters`/`extra-trusted-public-keys`; removed nixos.org cache endpoint and its public key; removed `use-xdg-base-directories` setting.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

feat(hm): add syncthing service and enhance nix config #1259 — Modifies the same Nix configuration file with similar changes to cache and trust key settings.
devenv #369 — Updates Nix substituters and trusted-public-keys configuration patterns across the dotfiles.

Suggested labels

bug

Poem

🐰 The cache hops away, nixos.org no more,
Extra keys bloom where the standard swore,
Base directories fade like morning dew,
A leaner config, simpler and new! 🌿

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: using extra-substituters to fix untrusted user warnings.
Description check	✅ Passed	The description is well-related to the changeset, providing clear rationale and explaining the problem being solved.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/nix-untrusted-substituter-warnings

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

mesa-dot-dev · 2026-04-04T14:22:17Z

Mesa Description

TL;DR

Replace substituters / trusted-public-keys with extra-substituters / extra-trusted-public-keys in Home Manager nix settings, remove use-xdg-base-directories, and remove redundant cache.nixos.org entry to fix "ignoring untrusted substituter" warnings.

What changed?

Replaced substituters and trusted-public-keys with their extra- prefixed counterparts in Home Manager Nix settings.
Removed use-xdg-base-directories setting.
Removed redundant cache.nixos.org entry.

^{Description generated by Mesa. Update settings}

Copilot

Pull request overview

Updates Home Manager’s nix.settings to avoid “untrusted user” warnings by switching from restricted cache settings (substituters, trusted-public-keys, use-xdg-base-directories) to their non-restricted extra-* counterparts.

Changes:

Replace substituters / trusted-public-keys with extra-substituters / extra-trusted-public-keys.
Remove use-xdg-base-directories to avoid restricted-setting warnings for untrusted users.
Rely on Nix defaults for cache.nixos.org instead of redundantly specifying it.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-04T14:24:08Z

-        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+      extra-trusted-public-keys = [
        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
        "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="


The Garnix public key entry uses the identifier cache.garnix.io (no -1 suffix), while the other substituter keys follow the common <host>-1: pattern. If Garnix signs with a different key name (e.g. cache.garnix.io-1), Nix will treat signatures as untrusted and the cache will be ignored. Please verify the expected key name from Garnix and update the prefix so it matches the signing key identifier.

Suggested change

"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="

"cache.garnix.io-1:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="

cubic-dev-ai

No issues found across 1 file

gemini-code-assist

Code Review

This pull request updates the Nix configuration by transitioning from substituters and trusted-public-keys to extra-substituters and extra-trusted-public-keys, while also removing default NixOS entries and the use-xdg-base-directories setting. A review comment suggests reordering the public keys to match the order of the substituter URLs to improve maintainability and simplify verification.

gemini-code-assist · 2026-04-04T14:26:55Z

      ];
-      trusted-public-keys = [
-        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+      extra-trusted-public-keys = [


The order of keys in extra-trusted-public-keys does not match the order of URLs in extra-substituters. While this doesn't affect functionality, maintaining a consistent order (e.g., alphabetical or matching the substituters list) makes it significantly easier to verify that each cache has its corresponding public key and improves long-term maintainability.

* feat: add paperclip service (#1342) * feat: add paperclip service - Systemd service on kyber: runs `paperclipai run` via bun, depends on docker-postgres - Config via builtins.toJSON: external postgres on kyber, embedded on macOS - Setup script creates paperclip database on docker-postgres - Makefile target: `make systemctl-paperclip` * fix: add shellcheck disable and shell test coverage for paperclip * fix: correct shellcheck disable directive syntax * refactor: use config.template.json pattern for paperclip * refactor: rename setup.sh to hydrate.sh for paperclip * test: add auto-switch hook tests and update coverage spec * fix: remove EnvironmentFile from paperclip service (#1344) * fix: paperclip authenticated mode and required config fields (#1345) * fix: remove EnvironmentFile from paperclip service * fix: use authenticated mode on kyber, add required meta/logging fields * fix: add allowedHostnames for paperclip.shunkakinoki.com * fix: format config template json * fix: use trust auth for docker-postgres (#1346) POSTGRES_HOST_AUTH_METHOD=trust removes password auth for all connections. The password kept going out of sync after crash recovery, causing paperclip and other services to fail with 'password authentication failed'. Safe since postgres is only reachable from the host. * fix: use k8s postgres via DATABASE_URL, remove docker-postgres dep, add authenticated mode (#1347) * fix: use bun runtime for paperclip (pino-http node crash), k8s postgres via DATABASE_URL (#1348) * fix: use nix-profile bun path for paperclip service (#1350) * fix: add caret prefix to paperclipai dependency (#1349) * fix: use extra-substituters to avoid untrusted user warnings (#1351) * fix: run paperclip from cloned repo via pnpm dev:once (#1352) * fix: run paperclip from cloned repo via pnpm dev:once The global bun install flattens pino@10 + pino-http@10.5 together, but pino-http needs pino@9. The repo lockfile resolves this correctly with nested dependencies. Running from the repo avoids the crash. * fix: use bun run server/src/index.ts instead of pnpm dev:once * fix: pin pino@9.14.0 override, run paperclipai from dotfiles node_modules The bun flat hoisting was resolving pino@10 which is incompatible with pino-http@10.5. Pinning pino to 9.14.0 via overrides matches the paperclip repo's lockfile resolution and fixes the crash. * fix: use global bun paperclipai with pino override (#1353) * fix: use global ~/.bun/bin/paperclipai with pino override Propagate overrides from dotfiles package.json to ~/.bun/install/global/ so the global binary resolves pino@9.14.0 correctly. * test: add tests for npm-globals dependency overrides * fix: resolve GitHub Actions failures and code review issues - Fix non-portable \s regex to [[:space:]] in auto-switch.sh (shfmt compat) - Add jq dependency check alongside cswap - Use printf instead of echo for safer output - Fix claude-swap version from >=1.1.5 (non-existent) to >=0.7.1 - Add auto-switch.sh to Nix deployment config (default.nix) - Sort covered_scripts list alphabetically in coverage_spec.sh https://claude.ai/code/session_012GyQBesQGF1asTfKebWyLM --------- Co-authored-by: Claude <noreply@anthropic.com>

fix: use extra-substituters to avoid untrusted user warnings

2536bdd

Copilot AI review requested due to automatic review settings April 4, 2026 14:21

Copilot started reviewing on behalf of shunkakinoki April 4, 2026 14:22 View session

shunkakinoki enabled auto-merge (squash) April 4, 2026 14:23

Copilot AI reviewed Apr 4, 2026

View reviewed changes

cubic-dev-ai Bot reviewed Apr 4, 2026

View reviewed changes

gemini-code-assist Bot reviewed Apr 4, 2026

View reviewed changes

shunkakinoki merged commit 3304d5e into main Apr 4, 2026
44 checks passed

shunkakinoki deleted the fix/nix-untrusted-substituter-warnings branch April 4, 2026 16:03

coderabbitai Bot mentioned this pull request May 24, 2026

feat(nix): install grok, antigravity, bernstein via llm-agents.nix #1844

Merged

4 tasks

Navigation Menu

fix: use extra-substituters to avoid untrusted user warnings - #1351

fix: use extra-substituters to avoid untrusted user warnings#1351
shunkakinoki merged 1 commit into
mainfrom
fix/nix-untrusted-substituter-warnings

shunkakinoki commented Apr 4, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

mesa-dot-dev Bot commented Apr 4, 2026

Uh oh!

coderabbitai Bot commented Apr 4, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Poem

Uh oh!

mesa-dot-dev Bot commented Apr 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 4, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Apr 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
	"cache.garnix.io-1:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="

Conversation

shunkakinoki commented Apr 4, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Summary by cubic

Uh oh!

mesa-dot-dev Bot commented Apr 4, 2026

Uh oh!

coderabbitai Bot commented Apr 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Poem

Uh oh!

mesa-dot-dev Bot commented Apr 4, 2026

Mesa Description

TL;DR

What changed?

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 4, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Apr 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

shunkakinoki commented Apr 4, 2026 •

edited by cubic-dev-ai Bot

Loading

coderabbitai Bot commented Apr 4, 2026 •

edited

Loading