Just remember that NixOS is only for personal and hobby use cases, as it is maintained by a large community of people that can ship any code they want without review, anchored on the honor system. Think wikipedia anons managing your browser and password manager.
If you want high supply chain security appropriate for production use, it is a lot more work that a lot fewer people are willing to do, which means far fewer packages. Though probably the packages you need for a server or build system or minimalist workstation.
> Just remember that NixOS is only for personal and hobby use cases, as it is maintained by a large community of people that can ship any code they want without review, anchored on the honor system.
This is somewhat inaccurate, and loosely written.
It would be more meaningful to talk about the nixpkgs repository. If you wanted to, you could use Nix with your own vetted nixpkgs codebase.
Whether there are any contributors who can merge without review I'm not sure, but the typical path for contributions is to go through review.
It is permitted to merge code from anonymous people, who could be alter-egos of the maintainer themselves, or whoever stole their credentials. Code signing is not enforced and never will be. I authored the rejected RFC for enforcing code and review signing myself. It is at odds with the community honor system volunteer hobby contributors wish to maintain.
Review is entirely honor system in the nix ecosystem.
This is a hard truth I really need those promoting it for high security use cases to understand.
If you want high supply chain security appropriate for production use, it is a lot more work that a lot fewer people are willing to do, which means far fewer packages. Though probably the packages you need for a server or build system or minimalist workstation.
See https://stagex.tools for contrast.