---
title: "New format: Nix, with upstream support for NixOS"
description: "Cloudsmith now supports the Nix format, letting you host a public or private Nix binary cache, complete with Ed25519-signed packages and upstream proxying and caching against NixOS release channels."
canonical_url: "https://cloudsmith.com/changelog/new-format-nix-with-upstream-support-for-nixos"
last_updated: "2026-08-24T16:20:39.281Z"
---
# New format: Nix, with upstream support for NixOS



Cloudsmith now supports the Nix format, letting you host a public or private Nix binary cache, complete with Ed25519-signed packages and upstream proxying and caching against NixOS release channels. Your existing `nix build` and `nix copy` workflows point directly to Cloudsmith, with no new upload tooling required, and no self-hosted cache such as `nix-serve` to operate.

## How it works

Nix packages are content-addressed by store path rather than name and version, so packages are pushed to Cloudsmith using the native `nix copy` command instead of a CLI or website upload:

```json
{
  "_key": "6ea1b5220c15",
  "_type": "code",
  "code": "nix build\n\nnix copy --to https://nix.cloudsmith.io/OWNER/REPOSITORY --no-check-sigs STORE_PATH",
  "filename": null,
  "language": null,
  "markDefs": null
}
```

The `--no-check-sigs` flag is required because a locally built store path is unsigned; Cloudsmith signs it server-side using the repository's Ed25519 signing key.

Cloudsmith signs on every read rather than at upload, so a key rotation applies to all packages immediately with no backlog to re-sign, and multiple keys can be valid at once.

To consume packages, add the repository's public key to `trusted-public-keys` in your Nix configuration (or per-invocation via `--option trusted-public-keys`). Without it, Nix will refuse to substitute packages even though the HTTP request itself succeeds.

## Upstream proxying and caching

A Nix upstream points at a single NixOS release channel, for example, `nixos-26.05`:

```json
{
  "_key": "61c3db347955",
  "_type": "code",
  "code": "https://channels.nixos.org/nixos-26.05",
  "filename": null,
  "language": null,
  "markDefs": null
}
```

When a requested store path isn't cached locally, Cloudsmith fetches it from the configured channel, caches it, and serves it signed with the repository's key.

```json
{
  "_key": "7063a1a4020d",
  "_type": "callout",
  "content": [
    {
      "_key": "e7eabb0319f1",
      "_type": "block",
      "children": [
        {
          "_key": "6a8fe78f0fd4",
          "_type": "span",
          "marks": [
            "strong"
          ],
          "text": "Note:"
        },
        {
          "_key": "8abd3a858213",
          "_type": "span",
          "marks": [],
          "text": " To proxy multiple releases, configure one upstream per channel."
        }
      ],
      "markDefs": [],
      "style": "normal"
    }
  ],
  "markDefs": null,
  "variant": "info"
}
```

## Known limitation

Nix always resolves a package's full dependency closure before installing. On NixOS channels, dynamically-linked packages resolve to a `glibc` build whose closure includes a GCC bootstrap intermediate (`xgcc-*-libgcc`) that isn't published in the channel's manifest, so Cloudsmith cannot index or serve it. As a workaround, configure `cache.nixos.org` as an additional fallback substituter alongside your Cloudsmith repository.

## Get started

The Nix format is available in Early Access. For more details, see the [Nix repository](https://docs.cloudsmith.com/formats/nix-repository) documentation.