@raito

The project behind this blog post allows a formal input validation (maybe the better wording) by generate a single (fixed-) source file that is able to reproduce the full system build offline and air-gapped.

When your (nix-) project strictly uses reproduce able builds formulas, you will end up on every offline proof build with a bit-by-bit verify-able result.

The project skip the last step (sadly, similar to nixos current state) to manifest the output correctness with a single hash (eg. by building a hash tree over the produced output binaries) and leaves the last step (output verification) to the agency trusted toolchain.

https://github.com/applicative-systems/secure-supply-chain