[Nix-dev] Re: NixOS: New scheme

[Marc Weber]

> too coarse-grain, and it breaks the principle of least authority.  I

In general this is good. I really fail to see what difference it makes as
- the jobs are run as root anyway
- the jobs can run rm -fr / as root as well..

So in any case you have to trust the final job.nix file (wether it gets
passed pkgs or not.. You *should* have a look at it before using..)

And the only solution against that is having two branches, one dev
branch and one reviewed branch where everything beeing obviously
malicious isn't merged in..
I said obviously because nobody can afford having a look at each single
line which changes within nixos eg when upgrading software, we just have
to trust those authors.. And even having a look at all source lines
isn't enough because the bootstrapping compiler might have been
malicious automatically inserting some code which was not present within
the source code!
So in short I fail to see the benefits of using
  {dep1, dep2, dep3} :
  " ${dep1}/bin/tool "

over
  {pkgs} :
  " ${pkgs.dep1}/bin/tool "

But I see the benefits in the second case. And if you count the lines in
upstart/default.nix you see how much boilerplate because of the first
"scheme" has been written.

But I maybe missing something obvious..

And I'd like to propose trying not to waste time because a lot of things
can be done would enhance things.. ( cross compiling, adding xen ?, eg the python
stuff is not perfect yet. I'm working on that now.., allowing multiple
x-servers so that you can test one while keeping the old .., I guess you
have some suggestions as well)

Sincerly
Marc Weber