nixpkgs VS nixos-config

https://github.com/NixOS/nixpkgs/commits?author=neon-sunset

I see two signers in the top 6 displayed on https://github.com/NixOS/nixpkgs/graphs/contributors

For a single file script, nix can make the package management quite easy: https://github.com/NixOS/nixpkgs/blob/master/doc/languages-f...

For example,

```

Yes, Nix doesn't actually ensure that the builds are deterministic. In fact it works just fine if they aren't. There are packages in nixpkgs that aren't reproducible: https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aiss...

I'm not familiar with Bazel, but Nix in it's current form wouldn't have solved this attack. First of all, the standard mkDerivation function calls the same configure; make; make install process that made this attack possible. Nixpkgs regularly pulls in external resources (fetchUrl and friends) that are equally vulnerable to a poisoned release tarball. Checkout the comment on the current xz entry in nixpkgs https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/comp...

NixOS uses a monorepo and I think everyone's love it.

I love being able to easily grep through all the packages source code and there's regularly PRs that harmonizes conventions across many packages.

Nixpkgs doesn't include the packaged software source code, so it's a lot more practical than what Debian is doing.

https://github.com/NixOS/nixpkgs

In this specific case, nix uses fetchFromGitHub to download the source archive, which are generated by GitHub for the specified revision[1]. Arch seems to just download the tarball from the releases page[2].

[1]: https://github.com/NixOS/nixpkgs/blob/3c2fdd0a4e6396fc310a6e...

[2]: https://gitlab.archlinux.org/archlinux/packaging/packages/ib...

True, but irrelevant -- _some packages_, _somewhere_, do depend on xz, which, if built, requires pulling the source from GitHub (see the default.nix: https://github.com/NixOS/nixpkgs/blob/nixos-23.11/pkgs/tools...)

It's not the vulnerability that's a problem right now (NixOS was protected by a couple of factors) but rather GitHub's hamfisted response.

That is the problem.

I’ve been using Nix directly on MacOS with minimal issues for a few years now. Works great.

I hate using docker on Mac and have since replaced it with flakes and devenv.

My configuration with a step by step guide (600+ stars): https://github.com/dustinlyons/nixos-config

I tried to make Nix as easy to adopt as possible by creating Nix commands and a step by step guide: https://github.com/dustinlyons/nixos-config

I love Nix. I use it every day to manage multiple local dev environments. And I use devenv instead of docker for sharing project-specific environments with others.

Felt (still am, actually) this problem too. Started with the same approach (Vanilla Emacs) a few years back in order to really learn the ins-and-outs after giving DOOM and others a shot and feeling like I didn't have the faintest what was really going on with all the magic. I somehow did end up falling in love with Emacs again[^1].

Won't lie... there was a fair amount of cursing involved and, despite the love, I wouldn't recommend many to venture down this road[^2].

Now I have gone the literate config way in my dotfiles https://github.com/vidbina/dotfiles/tree/main/emacs and I jump between Cursor (vscode-based), Neovim and Emacs for different tasks on a daily. I also found dustinlyons/nixos-config (https://github.com/dustinlyons/nixos-config/blob/main/module...) just a few days ago and figured that could be a fun resource when you're building yours up.

Take it as a hobby. There are a bunch of nice things that I picked up from Emacs (a. literate configs, b. comfort around working with LISPs, c. bigger appreciation for parts of the GNU ecosystem, d. more in-depth understanding of how my editor works which helps me debug issues in Neovim or vscode when I see them) but I still think that I'm cursed by wanting to go down this road so badly. Wish I could just vscode my way through live and build dope stuff, unencumbered.

1: Used Emacs heavily in college over 12 years ago when I would boot the Windows + Novell groupware school computers into my own Ubuntu config with my Emacs and embedded dev toolchain from my pendrive.

2: The single-threaded-ness and related ocassional unresponsiveness/hangups still grind my gears.

Here is my flake using home manager on Mac: https://github.com/dustinlyons/nixos-config

What do I need to do to switch from an official Nix install to using nix-installer on macOS? Just uninstall the current nix and install using nix-installer?

My config is loosely based off https://github.com/dustinlyons/nixos-config if this matters. Using nix-darwin.

My configuration uses Nix.

Not my personal notes, but how I do my writing and organize my thoughts. This is my Nix configuration that powers my Macbook, Linux PC, and home lab server. Emacs + org-roam to capture everything. https://github.com/dustinlyons/nixos-config