Hydra is the CI/CD platform executing jobs (the nixpkgs/NixOS job is defined in nixpkgs itself). Having lurked for some years in the NixOS community I think it

Hydra is the CI/CD platform executing jobs (the nixpkgs/NixOS job is defined in nixpkgs itself). Having lurked for some years in the NixOS community I think it's too early to insinuate wrongdoing. It's no guarantee, but I believe all core contributors are giving their best. If malware gets distributed it's from upstream-compromised software. The technological basis for verifiable IT is not well developed for now, but my guess would be they'd embrace it immediately (many core contributors come from the functional programming community). As things are, they are looking for resources to make core development sustainable. There's a million things to do (just look at the nixpkgs bug tracker). Cachix and hydra and the labor are expensive... And dunno about the political angle. That sort of shit is part of life for decades in the distro space (and in most organisations of any kind) and we'll manage.