Graham Christensen

@grahamc.com

determinate.systems. Nix obsessed. he/him đź“» no5ig

Hey y’all, I could use help: if you’re using the determinate nix installer in GitHub actions and you’re seeing an increase in CI failures — let me know? We’re slowly rolling out a new version and suspect there is an edge case we haven’t covered.

An awkward UX issue of Determinate Nix is that we serve it from FlakeHub Cache, which has no unauthenticated access. We do that to make the auth backend very straightforward, avoiding complexity that could lead to leaking customer cache entries. But...

The next release of Determinate Nix will start addressing two issues that commonly confuse our users: 1. `nix-channel` is deprecated, and using it will issue a warning. 2. Using an indirect flakeref or implicit registry input in a flake.nix will also raise a warning. >>>

Determinate Nix 3.3.1 is now out and folks, it is not playing games. We've added JSON logging to Nix and a whole new UX around fixing hash mismatches during Nix builds—and we've fixed some long-standing paper cuts to boot. determinate.systems/posts/change...

Changelog: JSON logging, a new experience around hash mismatches, and more

JSON logging has the potential to unlock all kinds of ergonomic benefits, starting with hash mismatches but with plenty of room to expand beyond that

determinate.systems

Let’s be real: any GitHub Action could expose your secrets at any time. Just look at the latest CVE uncovered in the popular tj-actions/changed-files Action. Static, long-lived secrets are a major 🚩. The solution? Don't rely on them, there is a better way. 🧵👇

This Firefox ToS hubbub is wild. It is amazing they didn't have one before. Lawyers like to spell out things like "If you type things into our program, we will do things with it." Which is the fundamental operating principle of a browser! You type things into it, and things happen!