> the risk of supply chain attack on the nix cache
Do you not trust hydra, the infra hosts, the people, all of it? What could be done to improve the cache's posture?
Do you not trust hydra, the infra hosts, the people, all of it? What could be done to improve the cache's posture?
It seems the current situation is there is a single signing key that has been in use since 2015 which implies that key is not tied to specific hardware and therefore could be leaked/exfiltrated/copied: https://github.com/NixOS/rfcs/pull/149/files#diff-ac4cc42774...
Have you measured the gains from your source-based approach? I was into Gentoo for tuning a long time ago when hardware wasn't as powerful, but I hadn't considered optimizing at that level with nix.