Module resign 

Re-sign every narinfo already in a cache.

── WHY THIS EXISTS ─────────────────────────────────────────────────────── A cache’s stored Sig: lines are only as good as the fingerprint the signer computed when the entry was INGESTED. When that computation is corrected — or when the signing key rotates — every entry written before the change carries a signature that will never verify, and nothing in the normal serving path repairs it.

server::sign_narinfo_text deliberately will not: it skips any narinfo that already carries a signature under our key name, so it does not double-sign on re-ingest. That guard is correct for ingest and is exactly what makes a BAD signature permanent — the stale signature is by our key, so it reads as “already signed” forever.

Measured 2026-08-08 on the fleet origin (rio): 6,668 narinfos signed over a hex fingerprint while Nix fingerprints in Nix-base32, so every consumer discarded every path with “not signed by any of the keys in trusted-public-keys”. Only paths that happened to be REBUILT and re-pushed after the fix were repaired; the rest needed this.

── WHY REWRITE THE narinfo AND NOT RE-PUSH ─────────────────────────────── A re-push re-uploads the NAR — 12 GiB on that origin — to change one line of text, and it can only cover paths whose store path still exists locally. Re-signing reads and rewrites the narinfo alone: O(entries), not O(bytes), and it works for entries whose original store path is long gone.

Structs

ResignReport

Outcome of a re-sign sweep.

Functions

resign_all

Re-sign every narinfo in storage under signer’s key.