In reply to @reckenrode:matrix.org
I want to see how badly things break actually doing builds on case-sensitive APFS.

In reply to @emilazy:matrix.org
you'll need to set temp-dir to be in the partition too

https://lix.systems/blog/2025-06-24-lix-cves/

Hardening the build directory

As mentioned earlier, Lix used to rely on a shared temp directory to stage builds before copying them to the Nix store.

A better approach is to move the build directory into a location that’s under the exclusive control of the Nix daemon.

That’s what we’ve done: Lix now stages builds in /nix/var/nix/builds, a secure area controlled by the daemon.

In reply to @emilazy:matrix.org
you'll need to set temp-dir to be in the partition too

According to the blog post about the recent CVEs, they moved it in the fixed daemon.

https://lix.systems/blog/2025-06-24-lix-cves/

Hardening the build directory

As mentioned earlier, Lix used to rely on a shared temp directory to stage builds before copying them to the Nix store.

A better approach is to move the build directory into a location that’s under the exclusive control of the Nix daemon.

That’s what we’ve done: Lix now stages builds in /nix/var/nix/builds, a secure area controlled by the daemon.

  nix.settings = {
    use-case-hack = false;
    temp-dir = "/nix/tmp";
  };

  system.activationScripts.preActivation.text = ''
    mkdir -p /nix/tmp
    chmod 1777 /nix/tmp
  '';