On 24-08-2022 05:07, Philip McGrath wrote:
> I could imagine a process like this:
>
>   1. Build the binary that needs to be signed.
>   2. Outside of the Guix build environment, create a detached signature
>      for the binary using your secret key.
>   3. Add the detached signature to the Guix store, perhaps with 'local-file'.
>   4. Use Guix to attach the signature to the built binary.
>   5. Use the signed binary in your operating-system configuration.

To implement this, you could have a look at "dynamic dependencies" in 
guix/store.scm and guix/graftsscm.

 From the with-build-handler docstring:

> Build handlers are useful to announce a build plan with 
> 'show-what-to-build'
> and to implement dry runs (by not invoking CONTINUE) in a way that 
> gracefully
> deals with \"dynamic dependencies\" such as grafts---derivations that 
> depend
> on the build output of a previous derivation."

On grafts: the derivation of the grafted version depend on what the 
references of the store item used to be, this can only be decided 
outside the store (kind of similar to this situation).

Greeetings,
Maxime