I'm an untrusted user and nix asks me to set `extra-trusted-public-keys` from a flakes `nixConfig` and then ignores me

[NobbZ]

Describe the bug

Given a flake with a nixConfig attribute, nix asks me to confirm all the settings, just to tell me that it ignores what I just did, as I am not a trusted user.

So why does nix bother me at all?

Steps To Reproduce

1. run nix run github:viperML/dotfiles#resolve-march-native
2. Accept the substitutor and the public key
3. See that "untrusted substituter" will be ignored

Expected behavior

Either adhere to my choice and use the substituters or do not bother me with questions.

nix-env --version output

$ nix --version
nix (Nix) 2.10.0pre20220629_b7eb4ac

[thufschmitt]

Yes, that's an annoyance. It's a bit tricky to get right with the current architecture -- the first check is done purely on the client side, while the second one happens purely on the daemon side, and they might not agree on what is allowed or not. Bu we should find a way to avoid this very confusing behavior

[NobbZ]

Perhaps some nix config would be nice?

flake-disallow-config = *

To generally assume "no" for all nixConfig leys

flake-disallow-config = extra-substituters substituters

To disallow only those 2?

Or allow whitelisting in flake-allow-config or how its called, rathaer than a pure boolean switch?

[thufschmitt]

Perhaps some nix config would be nice?

I could probably help, indeed. Although the main issue here I think is people getting utterly confused when they see that for the first time, and that wouldn't be enough for that.

Maybe what we could do is add the ability to query the daemon for the options it accepts, and only prompt the user for these. But that would also mean knowing which options are used only by the daemon, which we don't atm

[nixos-discourse]

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/how-do-i-contribute-bandwidth-or-computational-power-to-the-community/23391/7

[thufschmitt]

Closing in favour of #6672 since they are a duplicate of each other