3 ms·

Is the nixpkgs repo more "resilient" to these kind of attacks since an attacker would need the approval of a member with merge permission ?

Krutonium 4mo ago
Assuming you're not pulling in software from outside of nixpkgs, Yes.
- lostmsu 4mo ago
  Why? AFAIK original source is never reviewed, only the change in nixpkgs. So if the original is compromised, the malware will make it to nixpkgs.
  - Krutonium 4mo ago
    The scope of nixpkgs is nixpkgs. If every package's entire source code was being audited, then there is no such thing as a sustainable repository of software. There simply isn't enough people, or money for AI, to do it.
    - lostmsu 4mo ago
      > or money for AI, to do it. OpenAI and Anthropic both provide free credits for OSS. Smaller models feasibly can review every commit IMO. Would not be cheap for sure, but also would probably be cheaper than a single fulltime employee.
      - Krutonium 4mo ago
        This would amount to auditing the vast majority of open source code found on the Internet. Not even OpenAI or Anthropic seem quite interested in doing that.
schonfinkel 4mo ago
Kinda, you'd have to go through the whole review process and also get your stuff to successfully be part of (at least) an unstable build. What really worries me is that on Nix we have a strong habit of patching packages to work around problems caused by the fact that NixOS doesn't use FHS. So, in theory, someone could submit an obscure patch to systemd and get everyone affected by it, if it through the approval process. The solution so far has been a very rigorous process to even get a commit bit into nixpkgs: https://github.com/NixOS/nixpkgs-committers https://github.com/NixOS/nixpkgs-committers
- soraminazuki 4mo ago
  I'm sure PRs to the systemd package will get scrutinized by an experienced packager. Also Nixpkgs isn't really that special when it comes to patching. Making thousands of software all work coherently on a single system inevitably requires heavy amount of pop patching. Nixpkgs actually handles this better by having easier ways to make customizations.

Krutonium 4mo ago

Assuming you're not pulling in software from outside of nixpkgs, Yes.

lostmsu 4mo ago
Why? AFAIK original source is never reviewed, only the change in nixpkgs. So if the original is compromised, the malware will make it to nixpkgs.
- Krutonium 4mo ago
  The scope of nixpkgs is nixpkgs. If every package's entire source code was being audited, then there is no such thing as a sustainable repository of software. There simply isn't enough people, or money for AI, to do it.
  - lostmsu 4mo ago
    > or money for AI, to do it. OpenAI and Anthropic both provide free credits for OSS. Smaller models feasibly can review every commit IMO. Would not be cheap for sure, but also would probably be cheaper than a single fulltime employee.
    - Krutonium 4mo ago
      This would amount to auditing the vast majority of open source code found on the Internet. Not even OpenAI or Anthropic seem quite interested in doing that.

schonfinkel 4mo ago

Kinda, you'd have to go through the whole review process and also get your stuff to successfully be part of (at least) an unstable build. What really worries me is that on Nix we have a strong habit of patching packages to work around problems caused by the fact that NixOS doesn't use FHS. So, in theory, someone could submit an obscure patch to systemd and get everyone affected by it, if it through the approval process. The solution so far has been a very rigorous process to even get a commit bit into nixpkgs: https://github.com/NixOS/nixpkgs-committers https://github.com/NixOS/nixpkgs-committers

soraminazuki 4mo ago
I'm sure PRs to the systemd package will get scrutinized by an experienced packager. Also Nixpkgs isn't really that special when it comes to patching. Making thousands of software all work coherently on a single system inevitably requires heavy amount of pop patching. Nixpkgs actually handles this better by having easier ways to make customizations.