Sign artifacts

Optional, and recommended. Make turbo sign every artifact it uploads and reject any download it can't verify.

With signatures on, turbo signs every artifact it uploads with an HMAC-SHA256 key, and it rejects any download whose signature doesn’t verify. The server never sees the key, so even someone holding your TURBO_TOKEN can’t slip in a build that your machines will run.

Turn it on for any cache that more than one person or CI job writes to. It takes one setting and a second shared secret, separate from TURBO_TOKEN. The token lets a client talk to the server. The key decides which artifacts turbo trusts.

Turn on signatures

1. Add signature to remoteCache in your root turbo.json:

   {
       "remoteCache": {
           "signature": true
       }
   }

2. Generate a key once, and store it in your secret manager:

   openssl rand -hex 32

3. Give every machine and CI job that shares artifacts that same key:

   export TURBO_REMOTE_CACHE_SIGNATURE_KEY='<your signing key>'

   In CI, store it as a secret beside TURBO_TOKEN. Use at least 32 bytes. turbo accepts shorter keys today, but its longerSignatureKey future flag rejects them.

4. Check that hits come from the server.

turbo treats an artifact it can’t verify as a miss. A machine with a different key misses on every signed artifact and runs the task again. A machine with no key can’t sign, so it uploads nothing. Artifacts uploaded before you turned signatures on miss once, and the next run replaces them with signed ones.

Change the key

Give every machine the new key at once. While some machines have the old key and some the new one, each side misses on the other’s artifacts. Once they all match, they share builds again.

Turborepo’s signature documentation covers the client side in more depth.