@nprofile1q... that's not sufficient :p

@nprofile1q... perhaps a hot take would be to acknowledge why this attestation thing is attractive and understand why it is useful and invite stakeholders to encourage the emergence of an European ecosystem for this, I don't think it's realistic to expect the average consumer not to need this; instead, we should rebuild attestation as a public benefit service tied to our legal systems for easy recourses

@nprofile1q... @nprofile1q... Yes, I absolutely agree

I have been contemplating introducing generic SAT solving primitives in the Nix language to experiment with these ideas, but I'm not convinced that version resolving is a good idea except by doing it like what Golang is doing but it's not permitted by all ecosystems…

@nprofile1q... I find it interesting that Nix is considered to do singular dependencies only, albeit there's the mention of the various frontend to transform into singular dependencies. I wonder if it has been considered that Nix could provide a builtin to perform version resolution in a package set, e.g. it should be possible given a large enough lockfile to do `builtins.resolveVersions pkgs "gcc" "≤ 14, > 9"` — nonetheless, I understand why the focus is on the peculiar approach of Nix-like systems