Is there any way you can force it to use only software that’s crypographically signed (not hashes)?

My understanding is that nix uses a mix of source-based packages that are automatically pulled without verifying the sources crypgographically.

Can I install nix securely (eg with apt) to run inside the free CI runners provided by GitHub, GitLab, and Codeberg?

You can pay for signed images from someone else

Can you tell me a bit more about this? Who are the major providers?

We do our pre-releases on CI runners for convenience. GitHub automatically kicks-off a build when we git push.

When it comes time to do a real release, we can just run the job locally on our build machines (this is easier thanks to docker). Because our builds are reproducible, we can just check that the hash matches on our local build and the one from the free GitHub CI runners. That way we don’t have to trust the infrastructure, but we can use it for free & easy iteration before our final release.

Thanks. I haven’t looked into podman much. It came up in our research, but I saw cosign in the docs and assumed it had the same vulnerabilities. I’d be curious of how to use podman with GPG (and assume you’re talking about the publishers signing the release, not me signing it?)

Do you have any examples of popular, public images that you can use with podman, and verify the signature with GPG? Do you have any link to any guide that shows how to do this?

Yes, you have to trust someone.

However, by using cryptographic signatures on release artifacts (eg container image layers), we can reduce that risk from having to trust tens of thousands of people to just one person.

That’s a hugely meaningful reduction of risk.

How could monitoring a firewall log protect you from a Publishing Infrastructure Compromise or MITM attack? It would just show the malicious image being downloaded from the expected source…

Because the hash comes from the same source as the image itself.

So if someone compromised the publishing infrastructure (or does a MITM attack), they can trivially maliciously modify the hash as easily as they can maliciously modify the image. It provides zero security to Publishing Infrastructure compromise.

A good historical example of this happening was when monero’s release infrastructure was comprimised. And here’s a great list of historically relevant cases where this happened:

• https://github.com/cncf/tag-security/tree/main/community/catalog/compromises

In the case of Monero, the users were able to verify that the release was malicious – because the cryptographic signature was invalid, and it was fixed very fast. If the user can only check checksums, they have literally no way to detect if the publishing infrastructure or a MITM attack is taking place.

but how do you verify the sources of what you’re fetching?

Is it coming from an unsigned git repo? That seems equally vulnerable

Open-Source Software.

Can I install nix securely (eg with apt) to run inside the free CI runners provided by GitHub, GitLab, and Codeberg?

ah, final rinse with freshwater makes sense. You’re not thaat abusive ;)

Pots look great! Thanks for sharing

As stated in OP, my understanding is that induction-capable stainless steel use a less corrosion resistant (nickle-free) outer layer.

You wash that in salt water, and it doesn’t rust?

I thought Meyer was one of those mega corp crap brands?

• https://www.worseonpurpose.com/p/your-cookware-got-worse-on-purpose

Have you ever dropped a cast iron dutch oven half a meter onto the glass-topped induction cooktop?

1x 28 cm coil + 2x 18 cm coils + 1x 14 cm

It replaces a gas range whose flame diameter is pitiful by comparison, but nobody with gas complains about this. I assume a 3-ply pan with a thick aluminum middle should eliminate that concern, since it’ll transfer the heat effectively through the whole pan – even if it’s just a small center circle flame.

my pans all have a cold outer rim

Which pans do you use? Is it clad with aluminum? If so, how thick is the aluminum layer?

Yikes. Yeah, warping on the bottom is a big no-go for induction. The heating loss is pretty exponential the further it is from the ceramic glass top above the coils.