Reduce reliance on the NixOS cache

[jonasnick]

The most concerning weakness in terms of security right now is the dependence on cache.nixos.org. Most likely users do not build packages that are in the cache themselves (which could be achieved disabling substitutes in the nix.conf). Most of NixOS is reproducible (https://r13y.com/).

Would it be useful to set up a build server ourselves and give the users the ability to compare the hashes in their nix store with our builds? If so, what would be the easiest and UX-friendliest way to achieve this?

[nixbitcoin]

We could also distribute the nix store hashes in a trust-less way by pinning the hash of hashes on a SSOT like DNS or the Bitcoin Blockchain.

[mmilata]

Trustix looks like an attempt to solve this problem: https://build-transparency.org/

[nixbitcoin]

As soon as Trustix is viable we should use it and also spin up our own cluster as part of the federation.