> production environment > in production Lol. If someone doesn't want to be executing random unverified binaries fetched from arbitrary online locations, then

> production environment > in production Lol. If someone doesn't want to be executing random unverified binaries fetched from arbitrary online locations, then they shouldn't write such things in their build scripts. That has nothing to do with Nix. The same goes for Makefile, or whatever.