Currently when running a private Nixery instance you can actually specify a full git commit hash for the Nix repository that you're using. If this repository i

Currently when running a private Nixery instance you can actually specify a full git commit hash for the Nix repository that you're using. If this repository is the upstream nixpkgs[1], or if your private repository follows the same rules about not importing anything without fully-pinned hashes, you can already get those guarantees about the image content with Nixery today! The one exception is packages that are not in the binary cache, end up rebuilt and aren't reproducible (the binaries might differ) - but NixOS is ~98% reproducible already[2]! [1]: https://github.com/NixOS/nixpkgs/ https://github.com/NixOS/nixpkgs/ [2]: https://r13y.com https://r13y.com