tazjin

Hmm, this is a bit tricky potentially. In NixOS these environment variables are set up by a setup hook, which exports variables with the full store paths of the certificates....

Yeah, we can set environment variables (the builder code is part of Nixery itself) in the image. The question is what to set them to. I have some ideas, but...

The public Nixery instance only serves images that use packages that are in the Nix binary cache, however this package isn't cached for arm64. There unfortunately isn't a good way...

Hey! Thanks for flagging this. I think I see what's going on: ``` tazjin@vauxhall ~> nix-build -E '(import {}).go'; and ls -lh result/ /nix/store/h0wih1nab037j9biy39laagl5dwlgp29-go-1.13.6 total 8.0K lrwxrwxrwx 1 tazjin primarygroup...

Thanks, this is a good idea! Two thoughts: * I wonder if this should be on by default. Fetching all the required metadata is quite heavy, so it might be...

It should not do this without the feature being explicitly enabled, as the `signBlob` API unfortunately requires service account impersonation credentials. Useful to have though!

> if the mechanism is reasonably extensible, I'd like to propose a buildpacks meta-package that sets sufficient config metadata to use nixery for a buildpacks run image This is reasonably...

Thanks, I'll take a look!

I've started looking into this and it seems like I need to switch Nixery over to using the OCI image specification, as I can't find any references to the label...

Hey! This isn't currently possible, and it's not that trivial to implement since alternative users would first have to be created. My take is generally that this sort of stuff...