we build it ourselves from source in our secure, SLSA build level 3, controlled infrastructure
I’m happy to see more focus on provenance in Nix. Provenance is currently completely lacking in hydra.nixos.org and cache.nixos.org and we could do much better here.
Also it’s correct to say that a build artifact is SLSA build level 3, but it’s kind of meaningless to call infrastructure SLSA build level 3. SLSA unfortunately does little in asserting the correctness of build infrastructure except for some self-attestation saying that you should check that your build infrastructure is “Secure” but no standardised way into proving it is secure/(SLSA • Verifying build platforms).
There’s a build environment track that concerns with build infrastructure though which wants to assure things like build environment attestation but it’s still draft SLSA • Build Environment track
I think Nix can have an interesting role in these kind of things though but there’s a lot of room for improvement.
https://www.youtube.com/watch?v=UlJUpUQc9Lc was an excellent talk at NixCon about how we could empower Nix to not only prove Build provenance but also builder provenance**.
** Today even build provenance in nix is basically not existent. As our binary cache doesn’t sign over the deriver we don’t have any non-forgeable information on how an output path was produced. Which makes it kind of hard to reach any SLSA level with just plain Nix. What guarantees do signatures by binary caches give? - #13 by arianvp
Edit:
There’s a PR from Eelco to add (at this point unsigned) provenance info of store paths in the sqlite database. That’s useful Store path provenance tracking by edolstra · Pull Request #11749 · NixOS/nix · GitHub