It’s been a while! Nixpkgs core team events since our last update:
-
After discussion with the community team bootstrap group and within the Nixpkgs core team, we’ve proposed an initial policy covering the use of automation for Nixpkgs, including LLM‐based AI tools, for community review.
This is an area where people understandably have strong views, and which goes beyond technical matters to touch on legal and ethical concerns. It’s unlikely we can achieve complete consensus among contributors on the topic, and we’re willing to make judgement calls as necessary for the benefit of Nixpkgs, but we want to start out with a baseline policy that we think can gain strong consensus.
Therefore, we’ve focused on formalizing existing norms around automated contributions and applying them generally to include LLM‐based AI tools, ruling out what we think contributors will widely agree are clearly unacceptable cases: undisclosed use of complex automation, and automated contributions submitted without any manual review or understanding. The hope is that this will also give us more visibility with which to iterate further as necessary.
The core of the proposed policy is:
Every contribution to Nixpkgs and related development venues, including code, documentation, and communication on GitHub and Matrix, must have a responsible person in the loop who is accountable for that contribution and reviews it before submission, and must transparently disclose any non‐trivial use of automation to produce it, including but not limited to LLM‐based AI tools.
This policy takes inspiration from similar policies in LLVM, Mesa, Fedora, and the Linux kernel, along with a proposal by the author of Anubis. We’re also following the Rust project’s work on a more elaborate, stricter policy.
The pull request has (much) more detail and rationale. It’ll remain open for public feedback until the end of the week. We’re happy to hear concerns or suggestions, either on the pull request or in private.
-
Following on from our previous announcement, we have delegated a formal software provenance team with authority to make decisions regarding package provenance, SBOMs, software supply chain tracking, and related topics, and an initial mandate to shepherd design and implementation of a coherent vision for this in Nixpkgs. We look forward to seeing their work progress and helping facilitiate it as needed.
-
We participated in the security response and audit process for GHSA-67f2-674w-6g63, an incident where a committer’s GitHub personal access token with push access to Nixpkgs leaked in a public repository. Thankfully, after a comprehensive audit, we have comprehensively established that there was no compromise of the Nixpkgs source code as a result, with further details in the advisory. However, this incident has exposed systemic risks in the security of our GitHub infrastructure; efforts to address thesee are being tracked in NixOS/org#246.
-
We’re sorry about the marketing emails from GitHub many people received after the Enterprise Cloud upgrade. GitHub manually unsubscribed all members of the NixOS organization from these on our request in early February, so these should have stopped.
-
After our last update, our founding member @wolfgangwalther sadly left the team.
As we’re now down to two members, recruitment is a high priority for us to keep the team sustainable and help us flesh out our decision‐making, membership, and delegation procedures for the long term. We will start to reach out to potential candidates soon, and want to hear from you if you’d like to nominate yourself or someone else.
Candidates must be Nixpkgs committers, and a history of good communication and facilitation is of course a big plus. We generally work asynchronously over Zulip and don’t have constraints about time zones or meeting schedules, but given our consensus decision‐making we do need members to have enough availability to participate in discussions.
We plan to interview a shortlist of candidates and hope to announce new members by our next update. In the meantime, we apologize for the slower responses and updates; we have been busy with other matters and focused on keeping the lights on until we had the time to recruit in earnest.
