You probably know this, but a note for the benefit of people who don’t. The entire git history, including metadata, can be modified. Unless you have an independent offline remote to compare to, this method is not 100% guaranteed to detect tampering in all cases, for example if the nixpkgs repo is compromised (or your machines’ connection to your git forge is being MITM’d)
Comments
You probably know this, but a note for the benefit of people who don’t. The entire git history, including metadata, can be modified. Unless you have an independent offline remote to compare to, this method is not 100% guaranteed to detect tampering in all cases, for example if the nixpkgs repo is compromised (or your machines’ connection to your git forge is being MITM’d)