3 ms·
When that work is done, will it be a strong enough guarantee to use instead of just gpg-signing derivations? The father I dive into Nix, the more I get the fee
by thomastjeffery 3y ago
When that work is done, will it be a strong enough guarantee to use instead of just gpg-signing derivations?
The father I dive into Nix, the more I get the feeling that nixpkgs is only half of a package manager; and that the other half has been perpetually put on hold, while we wait for the eventual perfect implementation of Nix to make that half implicitly obsolete.
The more I use Nix (especially NixOS), the more I feel like that second half of the package manager is precisely what I am missing. Even when it it's obsoleted by guaranteed reproduciblity, I may still find value in it.
I would love to have a nix store that accommodates traditional gpg-signed packages. The usefulness of that would extend beyond Nix and nixpkgs.
- hamandcheese 3y ago> When that work is done, will it be a strong enough guarantee to use instead of just gpg-signing derivations? Derivations can be signed already, and are signed in the official cache I believe. You can configure which keys to trust. In that sense, it think it is possible to mirror the official cache.