3 ms·
Well, it is “just” a package manager in that all previous ones couldn’t really be called that as they were fundamentally faulty. Nix is the first package manag
by kaba0 4y ago
Well, it is “just” a package manager in that all previous ones couldn’t really be called that as they were fundamentally faulty.
Nix is the first package manager that actually solves dependency hell properly.
- diffeomorphism 4y agoNah, not really. Neither the first, nor properly, e.g grafting. Not saying it is not good at that, but not even nixOS claims this as a main selling point.
- lrvick 4y agoBut it makes dependency trust far worse since there is no code signing, review signing, or maintainer approval process.
- kaba0 4y agoThe binary cache works by signing, not sure if this is what you mean? By default you get the “upstream” channels as a trusted store, but you are free to add new ones and only ones that you added their keys of. Pretty sinilar to PPAs.
- lrvick 4y agoNix does blind automated signing of binaries which only helps prevent the cache from being mutated between builds. It does not ensure the code that went into those builds was accurate. See rejected RFC for more details: https://github.com/NixOS/rfcs/pull/34 https://github.com/NixOS/rfcs/pull/34
- vamega 4y agoIt appears that there is a maintainer approval process on nixpkgs prs? Am I wrong about that, or did you mean upstream approval process? Can you expand on the issue with code signing?
- lrvick 4y agoThe current process simply assumes Github credentials can never be stolen, and ignores countless cases where exactly that has happened. See rejected RFC for more details: https://github.com/NixOS/rfcs/pull/34 https://github.com/NixOS/rfcs/pull/34