As part of my install script, I run Vulnix.
Inevitably, I have to whitelist a batch of derivations just to use my operating system.
I will absolutely patch them for a mission-critical headless, minimal, low attack surface NixOS system… But that made me wonder
Could we assemble a special team of people that are security experts to go through the nixpkgs repository and patch/attempt to patch any of the vulnerabilities that are found using Vulnix?
The team’s priority would descend down the CVE severity spectrum. and I suppose If you want to get all tech-bro, you could have an LLM pre-investigate potential vulnerabilities to cut down on the wild goose-chases that would be inevitable in such a sprawling, diverse package ecosystem.
It seems like a worthy endeavor fraught with footguns and corner cases.
Does such an organization exist?
Does Nix’s foundation have funding for something like this?
Is this simply duplicating the (closed) work that Determinate Systems does for enterprise clients?