3 ms·
If you have sources, you have full control, using any distribution method. Some Nix packages are without sources, so this is not true for Nix.
by oddmiral 3y ago
If you have sources, you have full control, using any distribution method. Some Nix packages are without sources, so this is not true for Nix.
- otabdeveloper4 3y agoSupply chain management isn't about sources per se (though source makes it easier). What you need is hashes and signatures for every dependency at every step.
- oddmiral 3y agoIf you have sources, you can do anything you want at every step. If you haven't, then you can do fewer things at some steps. Some Nix packages have no sources, so full control is not available for them.