6 ms·

It is "just" another package manager, but with quite a few cool features. E.g. easily install different package versions in parallel, got new computer->just cop

It is "just" another package manager, but with quite a few cool features. E.g. easily install different package versions in parallel, got new computer->just copy over the configuration and nix takes care of the rest, want to make a docker container out of this app-> here you go. Neat, hence popular.

kaba0 4y ago
Well, it is “just” a package manager in that all previous ones couldn’t really be called that as they were fundamentally faulty. Nix is the first package manager that actually solves dependency hell properly.
- diffeomorphism 4y ago
  Nah, not really. Neither the first, nor properly, e.g grafting. Not saying it is not good at that, but not even nixOS claims this as a main selling point.
- lrvick 4y ago
  But it makes dependency trust far worse since there is no code signing, review signing, or maintainer approval process.
  - kaba0 4y ago
    The binary cache works by signing, not sure if this is what you mean? By default you get the “upstream” channels as a trusted store, but you are free to add new ones and only ones that you added their keys of. Pretty sinilar to PPAs.
    - lrvick 4y ago
      Nix does blind automated signing of binaries which only helps prevent the cache from being mutated between builds. It does not ensure the code that went into those builds was accurate. See rejected RFC for more details: https://github.com/NixOS/rfcs/pull/34 https://github.com/NixOS/rfcs/pull/34
  - vamega 4y ago
    It appears that there is a maintainer approval process on nixpkgs prs? Am I wrong about that, or did you mean upstream approval process? Can you expand on the issue with code signing?
    - lrvick 4y ago
      The current process simply assumes Github credentials can never be stolen, and ignores countless cases where exactly that has happened. See rejected RFC for more details: https://github.com/NixOS/rfcs/pull/34 https://github.com/NixOS/rfcs/pull/34

kaba0 4y ago

Well, it is “just” a package manager in that all previous ones couldn’t really be called that as they were fundamentally faulty. Nix is the first package manager that actually solves dependency hell properly.

diffeomorphism 4y ago
Nah, not really. Neither the first, nor properly, e.g grafting. Not saying it is not good at that, but not even nixOS claims this as a main selling point.
lrvick 4y ago
But it makes dependency trust far worse since there is no code signing, review signing, or maintainer approval process.
- kaba0 4y ago
  The binary cache works by signing, not sure if this is what you mean? By default you get the “upstream” channels as a trusted store, but you are free to add new ones and only ones that you added their keys of. Pretty sinilar to PPAs.
  - lrvick 4y ago
    Nix does blind automated signing of binaries which only helps prevent the cache from being mutated between builds. It does not ensure the code that went into those builds was accurate. See rejected RFC for more details: https://github.com/NixOS/rfcs/pull/34 https://github.com/NixOS/rfcs/pull/34
- vamega 4y ago
  It appears that there is a maintainer approval process on nixpkgs prs? Am I wrong about that, or did you mean upstream approval process? Can you expand on the issue with code signing?
  - lrvick 4y ago
    The current process simply assumes Github credentials can never be stolen, and ignores countless cases where exactly that has happened. See rejected RFC for more details: https://github.com/NixOS/rfcs/pull/34 https://github.com/NixOS/rfcs/pull/34