SBOM Attestation
SLSA Provenance Generation for Nix Builds
Nix's hermetic builds need external attestation to meet SLSA requirements.
Adaeze Okonkwo · October 18, 2026 · 8 min read
Derivation Ledger
▸ Latest
Derivation Ledger
A hands-on technical reference for platform engineers operationalizing Nix-based SBOMs, CVE remediation, and supply chain controls in real C
Environment Parity
Single Nix Flake Supporting X86-64 and Aarch64 Without SBOM Drift
Environment Parity
Why Runtime Toolchain Resolution Breaks Platform Team Reproducibility Guarantees
SBOM Attestation
Signing Nix-Generated SBOMs With Sigstore Cosign
Hermetic Build Patterns
Import From Derivation Risks in Hermetic Pipelines
Environment Parity
Nix-Based Developer Environment Onboarding Under Two Minutes
SBOM Attestation
Verifying Upstream Nixpkgs Derivation Provenance Before Consuming It
Hermetic Build Patterns
Nix Remote Builds for Architecture-Consistent Hermetic Outputs
01
View all →SBOM Attestation
02
View all →Hermetic Build Patterns
Hermetic Build Patterns
Disabling Implicit Dependencies in Nix for Full Hermeticity
Closing every route for undeclared dependencies to affect Nix builds.
Marcus Seilern · October 19, 2026 · 9 min read
Hermetic Build Patterns
Nix Build Reproducibility Verification With Diffoscope
Detect nondeterministic Nix builds by comparing outputs with content-aware diffing.
Priya Subramaniam · October 17, 2026 · 9 min read
Hermetic Build Patterns
Supply Chain Audit Requirements for Hermetic Builds in FedRAMP and SOC 2 Contexts
Hermetic builds turn compliance evidence into a build artifact rather than paperwork.
Marcus Seilern · October 16, 2026 · 10 min read