Ignoring nixConfig (extra-substituters, extra-trusted-pubic-keys).

[dschrempf]

Hi!

I have a question with respect to the extra-subsituters and extra-trusted-public-keys, which are set by the nixConfig attribute of this flake.

When I run an unfree program for the first time, I have to say that I am OK with these untrusted settings. Then, they are stored in ~/.local/share/nix/trusted-settings.json. Then, I get the following message when running programs:

warning: Using saved setting for 'extra-substituters = https://nixpkgs-unfree.cachix.org' from ~/.local/share/nix/trusted-settings.json.
warning: ignoring untrusted flake configuration setting 'extra-substituters'
warning: Using saved setting for 'extra-trusted-public-keys = nixpkgs-unfree.cachix.org-1:hqvoInulhbV4nJ9yJOEr+4wxhDV4xq2d1DK7S6Nj6rs=' from ~/.local/share/nix/trusted-settings.json.
warning: ignoring untrusted flake configuration setting 'extra-trusted-public-keys'

This is all fine and expected. However, I want a declarative setup and no hidden configuration files.

So, I added the substituter and the public key to nix.settings.substituters and nix.settings.trusted-public-keys, respectively. Nevertheless, I get the same procedure as described above. The declarative settings are not used. How can I load the Nixpkgs-Unfree flake and ignore the nixConfig bits? I could fork this repository, but that defeats its purpose, doesn't it?

[zimbatm]

Good question.

It looks like right now, Nix doesn't filter out known values from the nixConfig. Except for the internal whitelist items, all the other values are checked against the trusted list config. The only other option is to blindly trust all values with --accept-flake-config

See
https://github.com/nixos/nix/blob/ac0fb38e8a5a25a84fa17704bd31b453211263eb/src/libexpr/flake/config.cc#L53-L74

[dschrempf]

I do not think this is the right place for discussing this, but it would be great if one can set the configuratin of a flake during import, like with inputs.flakeWithDifferentNixpkgs.inputs.nixpkgs = "nixpkgs";.

Something like

inputs.nixpkgs-unfree.nixConf = {};