Zapstore on nostr

Open in Damus

> What is the source of the known hash? The known hash is manually entered in the package's Nix file. When adding a new package, you specify its source (e.g., Git or crates.io) and initially leave th...

Zapstore @Zapstore 1772460827

What stops the Nix repo maintainers from changing those hashes?

1

there is no nixpkgs maintainer, each package have its maintainers. if you just changed the hash to an incorrect one, nix will show you an error and the package won't be built. if you mean changing the source to a malicious source code, other maintainers or anyone else saw the incorrect source, the...