3 ms·

> where you don't need to actually sign your binary cache, but rather just sign a mapping between input hashes and content hashes. Though you can and should si

• mikepurvis 5y ago
  Of course, yes— that was what I was saying. But the theory with content-addressability is that unlike a conventional distro where the binaries must all be built and then archived and distributed centrally, Nix could do things like age-out the cache and only archive the hashes, and a third party could later offer a rebuild-on-demand service where the binaries that come out of it are known to be identical to those which were originally signed. A similar guarantee is super useful when it comes to things like debug symbols.