Bringing Nix ❄️ to the enterprise to empower fearless software delivery 💪
Joined March 2021
- Tweets895
- Following188
- Followers2.9K
- Likes517
Pinned Tweet
Today we're thrilled to announce the launch of our newest offering: Determinate Secure Packages. A drop-in replacement for Nixpkgs, it offers secure, signed, auditable Nix packages for the enterprise, including CVE monitoring and SLA-backed remediation, per-release SBOMs, optional FIPS-compliant builds, packages cached in FlakeHub Cache, cryptographic signing, and more. Link in thread 🔗🧵👇
We've released updates for today's PHP critical remote code execution vulnerabilities to Determinate Secure Packages (including FIPS variants). To be clear, this is in addition to our already-pushed fixes for the eMudhra intermediate CA compromise.
As always, we urge all customers to update their flakes as soon as possible. For more details, see our status page.
status.determinate.systems
We're pleased to report that we have pushed fixes for the eMudhra intermediate CA compromise for all distributions of Determinate Secure Packages (including FIPS variants).
We urge all customers to update their flakes as soon as possible. For more details, see our status page.
status.determinate.systems
We at Determinate Systems are fully aware of the eMudhra intermediate CA compromise and are moving as quickly as possible to push fixes to all distributions of Determinate Secure Packages ⛔ 🔏
We will notify you here when we have done so, and we advise you to update your flakes ASAP at that time. Until then, we'll push any important updates to our status page.
status.determinate.systems
Determinate Nix 3.23.3 is now out 🎉 ❄️ 🚀 and the multi-version changelog for this release covers security fixes for some Nix CVEs, a new feature we're calling "baked flakes," OpenTelemetry tracing, improvements to Wasm support and parallel eval, and so much more.
This is the one you really want, folks. Check out the blog post for a hefty list of recent changes 🔗
determinate.systems/blog/cha…
Great news for people who use Nix on macOS: our Native Linux Builder for Determinate Nix is now officially GA 🎉 🙌 🥳 🍎
That means that you can install Determinate Nix, log into FlakeHub, and immediately start building Linux derivations on macOS, without a request for access. No more remote builders or long-running local VMs, just seamless Linux builds with zero fuss. Read more on our blog 🔗
determinate.systems/blog/nat…
You may have seen a recent security advisory for Nix involving CVE-2026-110449, CVE-2026-110450, CVE-2026-110451, and a few others. Providing the most secure Nix possible is a top-line commitment for us, and we're happy to report that these CVEs were fixed in Determinate Nix v3.23.2, released last week. We strongly recommend updating ASAP 🔐 ❄️ 🚀
github.com/DeterminateSystem…
Hold on to your spans, folks, because Determinate Nix can now export OpenTelemetry traces 🔭 ❄️ 🚀
If you have burning questions like "where is Nix spending its time in CI?" you now have a wellspring of data that you can push to Grafana, Datadog, Honeycomb, Jaeger, and many others. Happy observing, Nixers 😎
determinate.systems/blog/det…
We're excited to announce a significant change to our Determinate Secure Packages offering with the introduction of long-term support (LTS). In a nutshell, we've begun to support some distributions for a full 5 years (beginning with 26.05) to better accommodate European CRA and many other use cases 🎉
LTS is available to all current and future customers starting now. Read more in our most recent blog post 🔗 🚀 ❄️
determinate.systems/blog/det…
If you’re at NixCon 2026 in the lovely Kraków 🇵🇱, we have a booth! Several of us will be camped out here throughout the conference, so don’t hesitate to come say hello and talk anything Nix, supply chain, Linux, and much more.
We’re proud to sponsor NixCon 2026!
Nix has moved well beyond being a powerful tool for individual developers and has become core infrastructure for companies that need software to be reproducible, secure, and reliable everywhere it runs.
At Determinate Systems, we’re building the platform enterprises need to adopt Nix with confidence.
See you in Kraków.
Good news for GitHub Enterprise users: FlakeHub now supports authentication via GitHub Enterprise Managed Users 🔐 🎉
This means that if your org's developers sign into GitHub using an external IdP like Entra ID or Okta or a SAML/SCIM-based solution, they can now log into FlakeHub via that same IdP, providing your org with a crucial identity governance win.
For in-depth details, check out today's blog post ❄️ 🚀 🔗
determinate.systems/blog/fla…
If you're headed to the wonderful Kraków 🇵🇱 for NixCon, come chat with other Nix folks (and us!) at our DetSys Happy Hour on Thursday, September 24th. No agenda, just free drinks and snacks, a lovely venue, and convivial Nix-y times. Register at the link below to find out the place and time 🔗 ❄️ 🚀 🍻
luma.com/detsys-1ts6
Yesterday, we announced the release of our new CVE remediation dashboard for Determinate Secure Packages 📈 ❄️ 🚀
Take a look if you haven't seen it yet 👀
security.determinate.systems…
Or if you're interested in a more detailed perspective, this new post on our blog should do the trick 🔗
determinate.systems/blog/sec…
Every CVE we fix for Determinate Secure Packages is now visible on a public dashboard 📊🔒
CVEs can be hard to keep tabs on, so we opted to make our SLAs fully trackable, with critical CVEs fixed within 7 days, high within 15, medium within 45, low within 90, and every tracked vulnerability plotted on a timeline by severity and deadline.
As of today: 988 fixed within SLA in the last 30 days, 84 open and on track, 0 overdue 😊
Come take a look yourself! ❄️ 🚀
security.determinate.systems
Determinate Nix 3.22.2 now out! 🎉
We've bumped upstream Nix to 2.35.2 and provided 5-12% faster evaluation with mimalloc, HTTP/3 binary cache fetching, faster `nix copy` in some scenarios, GC roots for `nix eval`, and @Replit auth for FlakeHub. This is the one you really want, folks ❄️ 🚀 🔗
determinate.systems/blog/cha…
We are proud sponsors of NixCon 2026 and we are excited to see many of you there! Let us know if you are attending using the linked form so you can receive invites to the events we are hosting outside of the conference. More details soon!
forms.gle/MqH29QpubqGWkGha8
Periodic reminder that FlakeHub serves flakes as tarballs from S3, completely independently of GitHub’s infrastructure. This is a great option to consider if you’re looking to harden your Nix workflows against GitHub outages 🔗
flakehub.com
FlakeHub isn't just easy, secure, and compliant... it's wildy fast, too!
The EU Cyber Resilience Act's first deadline is coming up on September 11 🇪🇺 From that date, you'll have just 24 hours to report an actively exploited vulnerability 📋
But don't fret! Determinate Systems is here to provide answers. Check out our latest blog post to see how Determinate Secure Packages, FlakeBOM, and FlakeAudit provide the SLA-backed CVE remediation, SBOMs, and CI gates that will enable you to get well out in front of these impending requirements 🔗 🚀
determinate.systems/blog/nix…
Determinate Nix 3.21.9 is now out! And it includes faster evaluation thanks to a fix in the store path cache plus an important cache key configuration change targeted to users of FlakeHub Cache in our FedRAMP environment. This is the one you really want, folks ❄️ 🚀 🔗
determinate.systems/blog/cha…