New format: Nix, with upstream support for NixOS

Cloudsmith now supports the Nix format, letting you host a public or private Nix binary cache, complete with Ed25519-signed packages and upstream proxying and caching against NixOS release channels. Your existing nix build and nix copy workflows point directly to Cloudsmith, with no new upload tooling required, and no self-hosted cache such as nix-serve to operate.

How it works

Nix packages are content-addressed by store path rather than name and version, so packages are pushed to Cloudsmith using the native nix copy command instead of a CLI or website upload:

nix build

nix copy --to https://nix.cloudsmith.io/OWNER/REPOSITORY --no-check-sigs STORE_PATH

The --no-check-sigs flag is required because a locally built store path is unsigned; Cloudsmith signs it server-side using the repository's Ed25519 signing key.

Cloudsmith signs on every read rather than at upload, so a key rotation applies to all packages immediately with no backlog to re-sign, and multiple keys can be valid at once.

To consume packages, add the repository's public key to trusted-public-keys in your Nix configuration (or per-invocation via --option trusted-public-keys). Without it, Nix will refuse to substitute packages even though the HTTP request itself succeeds.

Upstream proxying and caching

A Nix upstream points at a single NixOS release channel, for example, nixos-26.05:

https://channels.nixos.org/nixos-26.05

When a requested store path isn't cached locally, Cloudsmith fetches it from the configured channel, caches it, and serves it signed with the repository's key.

Known limitation

Nix always resolves a package's full dependency closure before installing. On NixOS channels, dynamically-linked packages resolve to a glibc build whose closure includes a GCC bootstrap intermediate (xgcc-*-libgcc) that isn't published in the channel's manifest, so Cloudsmith cannot index or serve it. As a workaround, configure cache.nixos.org as an additional fallback substituter alongside your Cloudsmith repository.

Get started

The Nix format is available in Early Access. For more details, see the Nix repository documentation.