Pre-roll transcript:

Before you is an episode of the Full Time Nix podcast.

For silence skipping and other useful features consider using a podcast app.

---

https://fulltimenix.com/episodes/martin-schwaighofer-steering-committee-candidate

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf

https://github.com/NixOS/nixpkgs

https://oxide.computer/

https://github.com/nix-community/lanzaboote

https://en.wikipedia.org/wiki/UEFI#Secure_Boot

NixCon2024 rebuilding builders instead of trusting trust
https://youtu.be/UlJUpUQc9Lc?si=_EebfQszx062M2mR

Extending cloud build systems to eliminate transitive trust:
https://discourse.nixos.org/t/extending-cloud-build-systems-to-eliminate-transitive-trust/50841

https://scored.dev/

https://reproducible-builds.org/

Build systems à la carte: Theory and practice
https://www.cambridge.org/core/journals/journal-of-functional-programming/article/build-systems-a-la-carte-theory-and-practice/097CE52C750E69BD16B78C318754C7A4?utm_campaign=shareaholic&utm_medium=copy_link&utm_source=bookmark

Implementing a content-addressed Nix, 2 December 2021 — by Théophane Hufschmitt
https://www.tweag.io/blog/2021-12-02-nix-cas-4/

https://github.com/nix-community/trustix

https://nixos.org/research/

00:00 Introduction and Background
01:28 Martin's Journey in Computer Science
02:57 Compiler Construction Course Insights
04:20 The Concept of Self-Compiling Compilers
07:10 Hiding stuff in the compiler
08:47 Trusting Trust: Compiler Security Issues
09:58 Nix and Build Process Management
12:09 Bootstrapping and Auditing in Nixpkgs
13:21 Trust in Software and Hardware Security
18:01 Secure Boot and Its Implications
20:39 Scenario: Government Agency Targeting
22:15 More on boot security
28:09 The Role of Secure Boot and Measured Boot
29:52 Measured boot
35:13 Democratizing Trust with Remote Attestation
36:11 Raising the bar on security
39:31 Research Directions in Supply Chain Security
47:34 Enhancing Nix for Security and Efficiency
50:20 Understanding Reproducibility in Build Processes
53:13 Navigating Trust and Threat Models in Nix
53:22 Identifying Gaps in Nix's Trust Mechanisms
56:48 Attribution and Trust in Build Systems
01:05:35 Distinguishing Between Input and Content Addressing in Nix
01:06:38 Nix store hashes
01:12:52 The Challenges of Content Addressing
01:14:04 Self-References and Their Implications
01:20:24 Trust and Attribution in Build Processes
01:24:31 Future Directions for Nix and Content Addressing
01:30:00 Sponsoring opportunity

Sponsor:

---

Nixcademy ad transcript:

Statistically speaking, Nix is a novel technology.
As such, adoption comes at an immediate cost of productivity.
Team members who know Nix find themselves preoccupied providing support
and the emergence of anti-patterns adds technical debt.
What's worse; morale is affected.

But, with training, these costs can be all but elimitated.
Founded by my friend and mentor Jacek Galowicz,
Nixcademy have brought hundreds of team members up to speed with Nix.
It's what they do.

So, liberate your Nix experts,
prevent technical debt
and get on top of Nix and back to work better and sooner.
Visit nixcademy.com.

Jacek tells me that most Nixcademy clients returned their investment in training in under three months.
They also provide free educational content that I recommend and a newsletter that I subscribe to.
nixcademy.com.

Determinate Nix ad transcript:

You may be a huge Nixer, seeking to apply it to everything at work.
But — security, compliance, and scale.
Enter Determinate Nix.
It is the Nix that powers our systems.
But with the governance, stability, and features to back an enterprise Nixer.
Such as:

- Parallel evaluation
- Out of the box native Linux builder on macOS
- Lazy trees
- Automatic certificate handling
- First-class mobile device management

And the list goes on.
Visit determinate.systems to find out how Nixers in charge of critical infra
such as finance and defense turn deterministic fantasy into reproducible reality.

determinate.systems

Post-roll transcript:

For past and future episodes search “Full Time Nix” on a podcast app or visit fulltimenix.com.

For 1-on-1 mentoring sessions with me visit mightyi.am.

Trust in Nix with Martin Schwaighofer

Full Time Nix

Trust in Nix with Martin Schwaighofer