Would someone have an opinion about dynamically registered builtin builders? Custom builders coming from a plugin.

I'm talking about https://github.com/NixOS/nix/pull/13138.

I've made a prototype of a plugin that would register a builtin to sign artifacts with a key held externally (HSMs / TPMs / accessible through an external API).

This allows to write a derivation like this:

builtins.derivation {
  name = "signed-modules";
  builder = "builtin:sign-modules";
  input = config.system.modulesTree;
  signerUrl = "http://server:8080";
  publicKeyFingerprint = "example-fingerprint-123";

  __noChroot = true;
  allowSubstitutes = false;
  outputs = ["out"];
}

Asking because in main, the builtin builders are currently in a "legacy builders" (https://git.lix.systems/lix-project/lix/src/branch/main/lix/legacy/builtin-builder.cc), so someone obviously has an opinion about that.

In reply to @baloo_:matrix.org
Yeah I've saw the subprocesses, I was raising the question before spending time in development to bring external builtins. And see if there was any interest (and get directions if any).

what secrets could they unlock

very subtle...

In reply to @baloo_:matrix.org
That's definitely not going to be an FOD.
Yeah UDS maybe. I'm very much in the prototyping phase and exploring ideas at the moment.