6 ms·
But it makes dependency trust far worse since there is no code signing, review signing, or maintainer approval process.
by lrvick 4y ago
But it makes dependency trust far worse since there is no code signing, review signing, or maintainer approval process.
- kaba0 4y agoThe binary cache works by signing, not sure if this is what you mean? By default you get the “upstream” channels as a trusted store, but you are free to add new ones and only ones that you added their keys of. Pretty sinilar to PPAs.
- lrvick 4y agoNix does blind automated signing of binaries which only helps prevent the cache from being mutated between builds. It does not ensure the code that went into those builds was accurate. See rejected RFC for more details: https://github.com/NixOS/rfcs/pull/34 https://github.com/NixOS/rfcs/pull/34
- vamega 4y agoIt appears that there is a maintainer approval process on nixpkgs prs? Am I wrong about that, or did you mean upstream approval process? Can you expand on the issue with code signing?
- lrvick 4y agoThe current process simply assumes Github credentials can never be stolen, and ignores countless cases where exactly that has happened. See rejected RFC for more details: https://github.com/NixOS/rfcs/pull/34 https://github.com/NixOS/rfcs/pull/34