3 ms·
Nix has upside that you just need to flip a symlink to do the same . Downside is that you don't have thinks like dm-verity that can prove that your update wasn'
by arianvanp 7y ago
Nix has upside that you just need to flip a symlink to do the same . Downside is that you don't have thinks like dm-verity that can prove that your update wasn't tampered with.
In nix the nix store is remounted over itself read-only, but nothing stops someone from ripping out the disk and flipping bits. This is not possible with these kind of 2-partition schemes if you have dm-verity set up
- rkangel 7y agoIsn't Nix a Merkle-Tree system of hashes? Doesn't that allow you to easily verify everything that you're running?
- the_duke 7y agoThis is possible in nix with "nix-store --verify --check-contents" .
- arianvanp 7y agoThat's different though. that's verification _after_ the fact, whilst dm-verity does it any time during block-level access. Also an attacker could modify the nix-store sqlite database and spoof the hashes, rendering this check moot