3 ms·
Nix caches are signed — what additional supply-chain attacks are you thinking of? I think if the attacker gets hold of a distribution machine + a trusted privat
by Twey 3y ago
Nix caches are signed — what additional supply-chain attacks are you thinking of?
I think if the attacker gets hold of a distribution machine + a trusted private key you're in trouble no matter your distribution model — even if you download every single package you use as source, carefully read it, and then build it yourself (which of course we all do) you're still vulnerable to ‘trusting trust’–style attacks.
- lrvick 3y agoSigned by a central server. Not by the actual authors. One stolen Github account or one compromised build server and the whole thing comes crashing down. Mature operating systems that have supply chain risks in their threat model like Debian, Arch, or FreeBSD, each author or maintainer signs every contribution which are verified end to end. Even a compromised Github or cloud provider employee can easily disrupt supply chains structured this way. In recent distributions like Nix and Alpine, contributors complained that generating a PGP key is too hard, so they just decided to yolo it as though NPM security was something to aspire to. Even proprietary operating systems like MacOS require code signing. Not mandating this is crazy. IMO anyone unwilling to learn how to maintain a personal identity key of some kind has no business maintaining packages for widely used operating system.