luj.fr
Blog

Writings

Thoughts on NixOS, software supply chains, and reproducible builds.

RSS feed
September 29, 2025·11 min read

My hopes and plans for the NixOS community

About me

I'm excited to share that I'm running for a seat on the NixOS Steering Committee. Before diving into my motivations, I'd like to take a moment to introduce myself — especially for those in the community I haven't had the chance to work with yet.

I am 28 years old and currently based in Paris, France. I have been involved in the NixOS community for about four years, with contributions spanning technical, organizational, and academic domains:

  • Technical work: I am a committer to nixpkgs, where I contribute to maintaining the systemd-boot backend; I am also the author of a port of the Proxmox hypervisor on NixOS.

  • Community involvement: I have helped organize NixCon 2022, participated in the coordination the NixOS devroom at FOSDEM in 2023 and 2024, and organized the Paris NixOS meetup;

  • Academic research: In the context of my PhD, I study the impact of functional package management on the software supply chain and explore possible avenues for improvement.

In addition, over the past five years I have served on the boards of several nonprofit organizations, which has given me experience in governance, collective decision-making, and community leadership.

Continue reading →
NixOSCommunitySteering-Committee
May 21, 2025·3 min read

Artiflakery, an easy way to distribute static Nix flake artifacts

The problem of slides distribution...

As a PhD student, I often do presentations. A lot of presentations. In 2024 alone, I gave about 15 talks in different public venues, with a different slideset at each of those occurrences. As often as I can, I try to make those slides available to the audience if they need to re-read them after my presentation, but it frequently happens that I forget to do so, for multiple recurring reasons:

  • I want to hold onto control of my slides a bit longer: they were not perfectly polished before the presentation, somebody pointed out a typo that I want to correct, in other words I am fine sharing the slides but I'd still like to be able to edit them;

  • I don't want to just send the files via email because the next time someone else will ask me for those slides, I'll have to duplicate that work again.

The solution to those (procrastination inducing) problems is extremely simple. I should upload my slides to my website, point people to that link, and if I ever need (or have time) to update the slides I could simply overwrite that file. So why I am not doing just that? Well, having to re-upload files each time I produce a new version is taxing, and I also like sharing "living" documents that get updated pretty often, so I needed something more automated.

Continue reading →
NixFlakesWebserver
March 20, 2025·35 min read

How NixOS and reproducible builds could have detected the xz backdoor for the benefit of all

Introduction

In March 2024, a backdoor was discovered in xz, a (de)-compression software that is regularly used at the core of Linux distributions to unpack source tarballs of packaged software. The backdoor had been covertly inserted by a malicious maintainer under the pseudonym of Jia Tan over a period of three years. This event deeply stunned the open source community as the attack was both of massive impact (it allowed remote code execution on all affected machines that had ssh installed) and extremely difficult to detect. In fact, it was only thanks to the diligence (and maybe luck) of Andres Freund – a Postgres developer working at Microsoft – that the catastrophe was avoided: while investigating a seemingly unrelated 500ms performance regression in ssh that he was experiencing on several Debian unstable machines, he was able to trace it back to the liblzma library, identify the backdoor and document it.

While it was already established that the open source supply chain was often the target of malicious actors, what is stunning is the amount of energy invested by Jia Tan to gain the trust of the maintainer of the xz project, acquire push access to the repository and then among other perfectly legitimate contributions insert – piece by piece – the code for a very sophisticated and obfuscated backdoor. This should be a wake up call for the OSS community. We should consider the open source supply chain a high value target for powerful threat actors, and to collectively find countermeasures against such attacks.

Continue reading →
NixOSReproducible-BuildsSoftware-Supply-ChainXZ-Backdoor
January 27, 2025·8 min read

Is NixOS truly reproducible?

Build reproducibility is often considered as a de facto feature provided by functional package managers like Nix. Although the functional package manager model has important assets in the quest for build reproducibility (like reproducibility of build environments for example1), it is clear among practitioners that Nix does not guarantee that all its builds achieve bitwise reproducibility. In fact, it is not complicated to write a Nix package that builds an artifact non-deterministically: 

let
  pkgs = import <nixpkgs> { };
in
pkgs.runCommand "random" { } ''
  echo $RANDOM > $out
''

Despite this, build reproducibility has historically been used as a marketing argument by the NixOS community, with the catchphrase "Reproducible builds and deployments/" appearing as a headline of the nixos.org page until 20232. This situation has even occasionally created tensions with members of the reproducible-builds group who dedicate a lot of time contributing patches in compilers and downstream projects to make them bitwise reproducible /for everyone, and prompted blog posts such as "NixOS is not reproducible" by Foxboron.

Continue reading →
NixOSReproducibilitySoftware-Supply-Chain