HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
NixOS
rfcs
Markdown2018–2026
NixOS / rfcs

rfcs

The Nix community RFCs

39Distinct people
64Mentions
2Explicit recommenders
659GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

The Nix community RFCs

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

Nix packages are blindly and automatically signed by a single private key last I reviewed it. Bribe or compromise one person and the entire model fails. There is good reason to…

lrvick used a recommendation phrase. 2 indexed comments match. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 8:03:49 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year64 dated mentions

Observed mentions: 2018-11-03 05:49:00 UTC to 2026-08-08 05:15:45 UTC.

0510152018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20182019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 4 mentions; 1 submissions, 3 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 6 mentions; 0 submissions, 6 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 6 mentions; 0 submissions, 6 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 10 mentions; 0 submissions, 10 comments20222023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 11 mentions; 2 submissions, 9 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 16 mentions; 0 submissions, 16 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 6 mentions; 0 submissions, 6 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC101
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC413
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC606
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC606
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC10010
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC1129
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC16016
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC606
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC404

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
NoteDue to the decreased activity in the RFC repository, and as also discussed in the previous meeting notes, we will transition the RFC process to a new on-demand work flow. More info here. Nix RFCs (Request For Comments) Many changes, including bug fixes and documentation improvements can be implemented and reviewed via the normal GitHub pull request workflow. Some changes though are "substantial", and we ask that these be put through a bit of a design process and produce a consensus among the Nix community. When this process is followed This process is followed when one intends to make "substantial" changes to the Nix ecosystem. What constitutes a "substantial" change is evolving based on community norms, but may include the following. Any semantic or syntactic change to the language that is not a bug fix Removing language features Big restructuring of Nixpkgs Expansions to the scope of Nixpkgs (new arch, major subprojects, ...) Introduction of new interfaces or functions Certain changes do not require an RFC: Adding, updating and removing packages in Nixpkgs Fixing security updates and bugs that don't break interfaces Pull requests that contain any of the aforementioned 'substantial' changes may be closed if there is no RFC connected to the proposed changes. Terminology RFC Steering Committee A team of people defined by RFC 36 and stays consistent until the team members are changed via a follow-up RFC. This committee is responsible for forming an RFC Shepherd team from the available nominations on each RFC. This team also names the leader of the Shepherd team. This has to happen within 1 week after the PR has been opened. Until then the Steering Committee is responsible for guiding the discussion. In case of the Shepherding Team not doing its work the Steering Committee shall encourage them or step in and assign new Shepherds. They also are in charge of merging accepted and rejected RFCs. Generally by these expectations they should find time to meet once a week for about an hour. They have no special responsibility with regard to the content of an RFC, they can weigh in on them, the same as any other community member, but are only in charge of: selecting the Shepherds unanimously supervising that the Shepherds are carrying out their work committing the final RFC Shepherd Team A team of 3-4 community members defined unanimously by the RFC Steering Committee, responsible for accepting or rejecting a specific RFC. This team is created per RFC from community members nominated in the discussion on that RFC. This team should be people who are very familiar with the main components touched by the RFC. The author cannot be part of the Shepherd Team. In addition, at most half of the Shepherd Team can be part of the RFC Steering Committee. The responsibility of the team is to guide the discussion as long as it is constructive, new points are brought up and the RFC is iterated on and from time to time summarise the current state of discussion. If this is the case no longer, then the Shepherd Team shall step in with a motion for FCP. Shepherd Leader The person in charge of the RFC process for a specific RFC, and responsible for ensuring the process is followed in a timely fashion. The Shepherd Leader has no special responsibility with regard to moving an undecided Shepherd Team to a certain decision. Final Comment Period (FCP) A period of ten calendar days, which will be called by the Shepherd Team after the RFC has received ample discussion and enough of the tradeoffs have been discussed. The Shepherd Team will propose to either accept or reject the RFC after the FCP. Process from Creation to Merge In short, to get a major change included in Nix or Nixpkgs, one must first get the RFC merged into the RFC repository as a markdown file under the rfcs directory. At that point the RFC is accepted and may be implemented with the goal of eventual inclusion into Nix or Nixpkgs. graph TD Start((Start)) --> Draft Draft -->|Ready for Review| Discuss style Draft fill:#008,color:#FFF Discuss[Discuss and Refine] Discuss ---> |On Hold| Draft Discuss --> |Can't Find Shepherds| NoShepherds Discuss --> |Motion for FCP| FCP NoShepherds[Closed - Lack of Interest]:::closed NoShepherds --> |Renewed Interest| Discuss FCP[Final Comment Phase] FCP --> |FCP Canceled| Discuss FCP --> |Accept| Merged FCP --> |Reject| Rejected Merged style Merged fill:#080,color:#FFF Rejected[Closed - Rejected]:::closed Withdrawn[Closed - Withdrawn]:::closed Discuss & Draft --->|Author Withdraws| Withdrawn classDef closed fill:#800,color:#FFF Loading Have a cool idea! Fill in the RFC. Put care into the details: RFCs that do not present convincing motivation, demonstrate understanding of the impact of the design, or are disingenuous about the drawbacks or alternatives tend to be poorly-received. Consider using Semantic Line Breaks in order to get better diffs on later amendments. Consider publishing your RFC as pre-RFC in the forum to gather initial feedback and iron out the remaining typos. In case your RFC is a technical proposal, you might want to prepare a prototype of your idea to firstly make yourself aware of potential pitfalls and also help reviewers understand the RFC. Code may be able to explain some issues in short. Submit a pull request. As a pull request the RFC will receive design feedback from the larger community, and the author should be prepared to revise it in response. For the nomination process for potential members of the RFC Shepherd Team, that is specific to each RFC, anyone interested can either nominate another person or themselves to be a potential member of the RFC Shepherd Team. This can already be done when submitting the PR. The RFC Steering Committee assigns a subset of the nominees to the RFC Shepherd Team and designates a leader for it. This has to be done unanim
Read the full README on GitHub

What Hacker News says

11 sources
Types of feeds I subscribe to: * News/blogs * Commits, e.g https://github.com/NixOS/rfcs/commits/master.atom * Discounts for games on my wishlist: https://isthereanydeal.com/ * LKML posts mentioning a device I use: https://lore.kernel.org/all/?q=GnuBee&x=A * Repology, to be notified when packages I maintain are out-of-date: https://repology.org/ * TLS certs issued for my domains, via https://crt.sh/ * Downtime notices, e.g. https://status.mythic-beasts.net.uk/status.rss It's by far the highest SNR and calmest notification channel I have.
In RSS can be used to distribute all sorts of information
My criticism is not so much on NixOS itself. If it wants to be a fun, composable, and easy to work on with minimal participation friction, fair enough. The yolo approach to contribution integrity has clearly resulted in fast development of ideas that might have been unable to grow in other distros. I suppose where my, perhaps misdirected, anxiety comes from is that I run a security consulting company and see NixOS being used as-is in high risk applications, to compile binaries responsible for protecting peoples property or safety, and on the workstations of production engineering teams. Places where it has no business being because supply chain integrity is a non goal. Maybe you are right though, and the answer is not trying to add supply chain security practices onto a community that does not want them, but to create a security focused f
Read the rest
ork of that distro that can inherit all that great community work and be a drop-in replacement for NixOS in environments where supply chain security is of critical importance. I tried and failed to get buy-in for even -optional- expression integrity support back in 2018 and gave up on nix after that. https://github.com/NixOS/rfcs/pull/34 I did prototype a git multisig solution in the years following that though: https://git.distrust.co/public/supsig https://git.distrust.co/public/git-sig It is already being used in production by some as nothing better exists atm. A security focused Nix fork that imports, reviews, and git-sig (or similar) signs commits from NixOS and has signature verification built into the package manager, is probably the only way forward, and I would be willing to ally with others interested in this.
In NixOS Reproducible Builds: minimal ISO successfully independently rebuilt
For some more context: Flawed as they are, Flakes solve a large number of problems Nix experiences without them. This is why I, and presumably many others, use them even in their current experimental state. An RFC was recently accepted to commit to forming a plan towards stabilization of Flakes: https://github.com/NixOS/rfcs/pull/136 Personally, I don't believe there won't be any breaking changes, but I also believe that the stabilization of Flakes is still a ways away and hope that there will be a reasonable migration path.
In NixOS and Flakes Book: An unofficial book for beginners (free)
lrvick·Jun 10, 2023Recommendation phrase
Nix packages are blindly and automatically signed by a single private key last I reviewed it. Bribe or compromise one person and the entire model fails. There is good reason to do this too given that many major blockchain projects use it for builds. Hundreds of millions to be made by one that impersonates the right maintainer before the right software release. Also no signed commits or signed authorship means someone with Github access can just fake history and inject whatever they want after code reviews are completed, which will then be blindly and automatically signed. Some of the people with write access to the nixpgs repo even have SMS recovery enabled on their github recovery email accounts. One sim swap to compromise all nix users. I will not call them out, but go try to do a email password reset on recent committers for yourself.
Read the rest
A malicious github employee could also of course do whatever they want to an unsigned repo. Or a well placed BGP attack. Lots of options. It is hard to prevent such things, but author commit signing would mitigate the risk and can be enforced. I made my case for this to the nix team but in the end it was concluded people would stop maintaining packages if they had to do the bare minimum like commit signing or hardware 2FA. https://github.com/NixOS/rfcs/pull/34 All this is fine, but it means effectively a decision was made for NixOS to be a hobby distro not suitable for any targeted applications or individuals. It really sucks, because I love everything else about nix design. Instead I am forced to bootstrap high security applications using arch and debian toolchains which are worse than nix in every way but supply chain integrity given that all authors directly sign package sources with their personal well verified keys. They have a ton of other security and even their own supply chain problems but they at least can survive phishing, a malicious mirror, or a sim swap. It is a low bar nix sadly does not meet.
In Nix/NixOS S3 Update and Recap of Community Call

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.