Notices by Paul Meyer (katexochen@infosec.exchange)

I went through the NixOS 25.11 release notes and picked some of the changes that I found particularly interesting. 🧵

#NixOS #nixpkgs

NixOS 25.11 has been released! 🎉

https://nixos.org/blog/announcements/2025/nixos-2511/

#NixOS #nixpkgs

TIL: `git archive` is used by GitHub and other forges to create an archive of a repo to download. git can do unexpected thing when creating such archive, like variable substitution using the `export-subst` feature. So even if a commit is immutable, you can still download different content if a ref or tag changed.

https://git-scm.com/docs/git-archive/2.46.0#Documentation/git-archive.txt-export-subst

Example: https://github.com/smallstep/cli/blob/master/.VERSION

That's a real problem in context of reproducible builds (or just source-pinning in general).

#ReproducibleBuilds #nixpkgs #nix #git #github