From da6f7d5d6ba698e35bed585d935fadacd9b9d13a Mon Sep 17 00:00:00 2001
From: Greg Hellings <greg.hellings@gmail.com>
Date: Thu, 19 Jun 2025 23:54:37 -0500
Subject: [PATCH] Sign before pushing to repo

---
 modules/nixos/remote-builder.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/nixos/remote-builder.nix b/modules/nixos/remote-builder.nix
index d32b0f2..e11ffbd 100644
--- a/modules/nixos/remote-builder.nix
+++ b/modules/nixos/remote-builder.nix
@@ -48,6 +48,7 @@ with lib;
             set -f
             export AWS_SHARED_CREDENTIALS_FILE=${config.age.secrets.cache-credentials.path}
             export IFS=' '
+            ${getExe config.nix.package} store sign --recursive --key-file "${config.age.secrets.private-cache.path}" "$@"
             ${getExe config.nix.package} copy --to "s3://binary-cache/?scheme=http&endpoint=nas.home%3A9000&profile=default" "$@"
           ''
         );