In reply to @qyliss:fairydust.space
The reason I said I didn't think Nix was well suited before, btw, is that with Nix it's basically impossible to figure out which code is actually being used at runtime. Of course that doesn't really matter, when any build dependency could have compromised that code, but my experience before has been that people don't care about build deps. Glad to hear that's not the case here.

Yeah I've not looked too much into the runtime aspect. I've had my colleagues complain they can't use nix on fedora with SELinux on 🙃 Your insight around that would be amazing

There is some work around keylime and validating SBOMs/Provenance at the kernel level before code runs so that might also help 🤷

In reply to @qyliss:fairydust.space
The reason I said I didn't think Nix was well suited before, btw, is that with Nix it's basically impossible to figure out which code is actually being used at runtime. Of course that doesn't really matter, when any build dependency could have compromised that code, but my experience before has been that people don't care about build deps. Glad to hear that's not the case here.

Yeah I've not looked too much into the runtime aspect. I've had my colleagues complain they can't use nix on fedora with SELinux on 🙃 Your insight around nix & runtime would be amazing

There is some work around keylime and validating SBOMs/Provenance at the kernel level before code runs so that might also help 🤷

that was just a sarcastic comment

I'm aware, as I said I found it funny too but it was also a good opportunity to get into how we improve some of this 😅 how we can show people the work that everyone has done around nix before they started showing an interest in supply chain