4.3.2 Substitute Server Authorization

To allow Guix to download substitutes from ci.guix.gnu.org or a mirror thereof, you must add its public key to the access control list (ACL) of archive imports, using the guix archive command (see Invoking guix archive). Doing so implies that you trust ci.guix.gnu.org to not be compromised and to serve genuine substitutes.

The public key for ci.guix.gnu.org is installed along with Guix, in prefix/share/guix/ci.guix.gnu.org.pub, where prefix is the installation prefix of Guix. If you installed Guix from source, make sure you checked the GPG signature of guix-1.1.0.tar.gz, which contains this public key file. Then, you can run something like this:

# guix archive --authorize < prefix/share/guix/ci.guix.gnu.org.pub

Once this is in place, the output of a command like guix build should change from something like:

$ guix build emacs --dry-run
The following derivations would be built:
   /gnu/store/yr7bnx8xwcayd6j95r2clmkdl1qh688w-emacs-24.3.drv
   /gnu/store/x8qsh1hlhgjx6cwsjyvybnfv2i37z23w-dbus-1.6.4.tar.gz.drv
   /gnu/store/1ixwp12fl950d15h2cj11c73733jay0z-alsa-lib-1.0.27.1.tar.bz2.drv
   /gnu/store/nlma1pw0p603fpfiqy7kn4zm105r5dmw-util-linux-2.21.drv
…

to something like:

$ guix build emacs --dry-run
112.3 MB would be downloaded:
   /gnu/store/pk3n22lbq6ydamyymqkkz7i69wiwjiwi-emacs-24.3
   /gnu/store/2ygn4ncnhrpr61rssa6z0d9x22si0va3-libjpeg-8d
   /gnu/store/71yz6lgx4dazma9dwn2mcjxaah9w77jq-cairo-1.12.16
   /gnu/store/7zdhgp0n1518lvfn8mb96sxqfmvqrl7v-libxrender-0.9.7
…

The text changed from “The following derivations would be built” to “112.3 MB would be downloaded”. This indicates that substitutes from ci.guix.gnu.org are usable and will be downloaded, when possible, for future builds.

The substitute mechanism can be disabled globally by running guix-daemon with --no-substitutes (see Invoking guix-daemon). It can also be disabled temporarily by passing the --no-substitutes option to guix package, guix build, and other command-line tools.