this post was submitted on 25 Jun 2023
8 points (100.0% liked)

nixos

46 readers
1 users here now

All about NixOS - https://nixos.org/

founded 4 years ago
8
Who makes Nix packages? (lemmy.ml)
submitted 1 year ago by agile_squirrel@lemmy.ml to c/nixos@lemmy.ml
10 comments fedilink hide all child comments
 

I'm new to Nix and wanted to get my feet wet by using the Nix package manager. However, I wasn't sure how these packages were made. Are these packaged by the community? Who do I need to "trust" when installing these packages? In general, I was looking for info on how nix packages are made and maintained.

you are viewing a single comment's thread
view the rest of the comments
[โ€“] help@lemmy.ml 4 points 1 year ago (1 children)

I'll be honest, I have no idea. Sometimes, I get nagged that a package is insecure, and it seems reasonable like an old version of Electron, and then I just sigh and add it to my list of packages to ignore that warning on.

[โ€“] agile_squirrel@lemmy.ml 2 points 1 year ago

I didn't find anything concrete, but it seems that a package is automatically marked insecure if it has a dependency that has a known CVE. I wonder how that is done.