2 ms·
The binary cache works by signing, not sure if this is what you mean? By default you get the “upstream” channels as a trusted store, but you are free to add new
by kaba0 4y ago
The binary cache works by signing, not sure if this is what you mean? By default you get the “upstream” channels as a trusted store, but you are free to add new ones and only ones that you added their keys of. Pretty sinilar to PPAs.
- lrvick 4y agoNix does blind automated signing of binaries which only helps prevent the cache from being mutated between builds. It does not ensure the code that went into those builds was accurate. See rejected RFC for more details: https://github.com/NixOS/rfcs/pull/34 https://github.com/NixOS/rfcs/pull/34