News for hackers. Stuff that matters.
Re:Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reprodu... by Ericson2314 on Monday June 21, 2021 @02:55PM (#27582654)
> where you don't need to actually sign your binary cache, but rather just sign a mapping between input hashes and content hashes.

Though you can and should sign the mapping!

Re:Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reprodu... by mikepurvis on Monday June 21, 2021 @03:28PM (#27583187)
Of course, yes— that was what I was saying. But the theory with content-addressability is that unlike a conventional distro where the binaries must all be built and then archived and distributed centrally, Nix could do things like age-out the cache and only archive the hashes, and a third party could later offer a rebuild-on-demand service where the binaries that come out of it are known to be identical to those which were originally signed. A similar guarantee is super useful when it comes to things like debug symbols.