[cwp]

Yeah, they're getting there. The binary package cache is a start. If it cached upstream tarballs and git revs as well as builds, it would mitigate the sort of thing the OP talks about.

Nix still needs some sort of distributed trust model, though. Without that, nixos.org is a single point of failure.

[manveru]

You can use your own binary caches and of course your own clone of nixpkgs repo. I think moving the binary caches to IPFS would also be a fun project.