you are right and thanks for adding on my ELI5. TBH I never used nixOS, only guix, which does not use a central key to sign packages, and uses signed commits (h

you are right and thanks for adding on my ELI5. TBH I never used nixOS, only guix, which does not use a central key to sign packages, and uses signed commits (https://guix.gnu.org/manual/en/html_node/Commit-Access.html https://guix.gnu.org/manual/en/html_node/Commit-Access.html) , the project is sponsored by the FSF and it's the official distro for the GNU project, so they take security very seriously. (You can always install a random channel and throw all that out of the window if you want). (quick edit) Guix packages are basically .scm (scheme) files on git, so the fedora/nix example does not apply either. Every file can be opened and inspected, most of them are basically a git clone + checking a hash. You can decide to use substitutes (binaries) or no, and substitutes are usually similar byte by byte across systems. As an example, this is the guix config for installing CRIU: https://git.savannah.gnu.org/cgit/guix.git/tree/gnu/packages/virtualization.scm#n1916 https://git.savannah.gnu.org/cgit/guix.git/tree/gnu/packages... Given said that, I am ready to spend some of my funemployment time installing and using nix as my daily driver for a few months, so I will have more info and first hand knowledge of all that.