Hm. That actually sounds doable (we do have hashes for integrity). I'll try that and see how it goes. > Instantly sounds like a whole reason to use nix and cap

Hm. That actually sounds doable (we do have hashes for integrity). I'll try that and see how it goes. > Instantly sounds like a whole reason to use nix and capture those tools as part of the dependency set. It's tempting, and I tried that, but ran away crying. We're using Docker images instead for now. We are also using direnv that transparently execs commands inside Docker containers, this works surprisingly well.