move substituter signature-checking conditions to configuration file documentation

1 files changed, 8 insertions, 0 deletions

diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh
index d7f351166..a659036e2 100644
--- a/src/libstore/globals.hh
+++ b/src/libstore/globals.hh
@@ -613,6 +613,14 @@ public:
           are tried based on their Priority value, which each substituter can set
           independently. Lower value means higher priority.
           The default is `https://cache.nixos.org`, with a Priority of 40.
+
+          Nix will copy a store path from a remote store only if one
+          of the following is true:
+
+          - the store object is signed by one of the `trusted-public-keys`
+          - the substituter is in the `trusted-substituters` list
+          - the `no-require-sigs` option has been set to disable signature checking
+          - the store object is [output-addressed](#gloss-output-addressed-store-object)
         )",
         {"binary-caches"}};