How do you sign Turborepo remote cache artifacts?

Set signature to true under remoteCache in turbo.json and provide a secret in the TURBO_REMOTE_CACHE_SIGNATURE_KEY environment variable. Turborepo then signs artifacts with HMAC-SHA256 before upload and verifies them on download. Any artifact that fails verification is ignored and treated as a cache miss.

Why sign a cache at all

A remote cache is a place where build outputs wait to be reused by other machines. If a person or process can alter an entry, every build that downloads it receives the altered output. Signing adds a check that the artifact was produced by someone who holds the key, and that it has not changed since.

Turborepo's remote caching page describes the feature as artifact integrity and authenticity verification: artifacts are signed with a secret key you provide, verified when downloaded, and any that fail to verify are ignored and treated as a cache miss.

Turn it on

In turbo.json:

{
  "remoteCache": {
    "signature": true
  }
}

Then supply the key as an environment variable in each place that reads or writes the cache.

export TURBO_REMOTE_CACHE_SIGNATURE_KEY="a long random secret from your secret store"

Rollout steps

1. Generate a long random key and store it in your secret manager, not in the repository.
2. Give the key to CI jobs that write the cache, and to developers only if they should be able to write signed entries.
3. Turn on signing, then clear existing unsigned entries or expect them to be misses.
4. Rotate the key on a schedule and after any suspected exposure. Rotation invalidates old entries, which is fine for a cache.
5. Combine it with a write restriction, covered in the post on cache read and write flags.

What signing does cover

What it does not cover

Signing proves who wrote the artifact, not that the artifact is correct. Three gaps remain.

• A holder of the key can sign anything. If a compromised CI job holds the key, it can sign poisoned output. Limit which jobs hold it.
• A wrong hash is still a wrong hash. If an environment variable is missing from the task hash, a correctly signed artifact can still be the wrong one for your build. See the post on strict and loose environment modes.
• Logs are artifacts. Turborepo treats task logs as cached artifacts, so a secret printed to the console may be stored and replayed.

Where Safeguard fits

Safeguard can inventory the dependencies your repository declares through SBOM and dependency scanning, and reachability analysis helps you decide which findings matter first. You can try a free scan on a repository to see what it finds. Check coverage for your specific build files before relying on it.

Quick check

Sources

• Turborepo documentation: Remote Caching
• Turborepo documentation: Using environment variables

Last reviewed: 19 October 2026.