Marcus Seilern

Evaluation-phase purity breaks when builds reshape the dependency graph mid-pipeline.

Closing every route for undeclared dependencies to affect Nix builds.

Hermetic builds turn compliance evidence into a build artifact rather than paperwork.

Nix's network isolation ensures builds can't fetch undeclared dependencies.

Reachability analysis cuts through vulnerability noise by tracing which flaws actually execute.

Nix treats package names as structural; authors treat them as cosmetic.

Nix scans binaries to automatically detect dependencies, guaranteeing complete closure graphs.

Nix's reproducibility guarantee has a blind spot that breaks supply chain integrity on purpose.