3 ms·
> the risk of supply chain attack on the nix cache Do you not trust hydra, the infra hosts, the people, all of it? What could be done to improve the cache's po
by chickensong 4mo ago
> the risk of supply chain attack on the nix cache
Do you not trust hydra, the infra hosts, the people, all of it? What could be done to improve the cache's posture?
- craftkiller 4mo agoOne suggestion for improving the cache's posture: Give each dedicated builder machine a TPM. On each builder, generate a TPM-backed signing key. Only use those TPM-backed keys for signing packages that end up in the cache. That way we'd ensure that signed packages _must_ have been built on the dedicated build machines (due to the TPM) rather than potentially uploaded from a compromised developer machine using a compromised signing key. It seems the current situation is there is a single signing key that has been in use since 2015 which implies that key is not tied to specific hardware and therefore could be leaked/exfiltrated/copied: https://github.com/NixOS/rfcs/pull/149/files#diff-ac4cc42774897d03700afa5e998e676b494ee685860d9ee08dfa2b14d7566273R22 https://github.com/NixOS/rfcs/pull/149/files#diff-ac4cc42774...
- chickensong 4mo agoA reasonable suggestion, for any code signing system really. We need all the help we can get these days. Have you measured the gains from your source-based approach? I was into Gentoo for tuning a long time ago when hardware wasn't as powerful, but I hadn't considered optimizing at that level with nix.