WoT verify pinned nixpkgs #162
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nixbitcoin
force-pushed
the
wot-verify-pinned-nixpkgs
branch
2 times, most recently
from
0710f70 to
2fff1ef
Compare
nixbitcoin
force-pushed
the
wot-verify-pinned-nixpkgs
branch
2 times, most recently
from
c093983 to
d0210d0
Compare
nixbitcoin
force-pushed
the
wot-verify-pinned-nixpkgs
branch
from
d0210d0 to
2629796
Compare
|
Rebased |
nixbitcoin
force-pushed
the
wot-verify-pinned-nixpkgs
branch
from
2629796 to
2f6cfb3
Compare
nixbitcoin
force-pushed
the
wot-verify-pinned-nixpkgs
branch
from
2f6cfb3 to
7ddc7fe
Compare
|
Is this still interesting @jonasnick @erikarvstedt? |
|
Closing because of lack of interest |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR includes a script that fetches nixpkgs-channels, checks out nixos-20.03 and nixos-unstable, verifies the last 14 commits against a set of predefined trusted (see #78 for definition of trusted) maintainer PGP keys, and returns lines to be included in
pkgs/pinned-nixpkgs.nix.The script also allows you to verify an existing nixpkgs-pinned.nix by passing the option
--verifyWe need to switch to
fetchurlin nixpkgs-pinned.nix so the signature verification makes sense. I also updatedpkgs/pinned-nixpkgs.nixin this PR as a demonstration of the first WoT verified update.Closes #78 #75