Hacker News Reader

Recently, President Biden put out an executive order that mandates that NIST et al work out, over the next year, an SBOM/supply chain mandate for software used by Federal departments.

That's going to require the equivalent of "chain of custody" attestations along the entire build chain.

Along with SOC and PCI/DSS and other standards, this is going to require companies and developers to adopt NixOS type immutable environments.

View on HN

Unfortunately, I don't think this is going to be the outcome. We're more likely to end up with "Here is the list of filenames, subcomponents, and associated hashes" as opposed to requiring NixOS style environments. Vendors to the subcontractors will likely be required to provide the same list of filename/subcomponent/hashes, a far cry from repeatable builds.

I doubt it will happen until NixOS or similar tool has a corresponding DISA STIG.

Reply on news.ycombinator.com