iiinova — where your digital self keeps evolving

Paul Meyer @katexochen.bsky.social · 22/09/2026

If you have some basic knowledge on TPMs, the blog post should provide good intro to the advanced concepts used in the design, and commands to follow along are provided.

000

Paul Meyer @katexochen.bsky.social · 22/09/2026

TPM PCRs are scarce, so systemd allocates PCR-like registers in the TPM's NV memory. The way these NvPCRs are securely anchored was reworked in v262. I wrote up how the new design works by rebuilding an NvPCR from scratch against a software TPM: katexochen.aro.bz/posts/system...

katexochen.aro.bz

Understanding NvPCRs in systemd v262

systemd answers TPM PCR scarcity with additional PCR-like registers allocated in the TPM’s NV memory, with an anchoring design that was reworked in v262. In this hands-on deep dive, we rebuild a syste...

100

Paul Meyer @katexochen.bsky.social · 29/04/2026

Building reproducibly is important for remote attestation but hard if artifacts contain signatures. I wrote about how we use ECDSA public key recovery to create secure, reproducible signatures, without anyone knowing a private key. katexochen.aro.bz/posts/reprod... #ReproducibleBuilds #Cryptography

katexochen.aro.bz

Secure signatures without a private key

Reproducible builds allow anyone to verify that a binary matches its source code. But what if the build artifact must contain a cryptographic signature? Reproducing the signature requires the private ...

000

Paul Meyer @katexochen.bsky.social · 07/04/2026

> [TEEs] and in general hardware attestation are just f***d. All their keys and roots are not PQ and I heard of no progress in rolling out PQ ones, which at hardware speeds means we are forced to accept they might not make it words.filippo.io/crqc-timeline/ #ConfidentialComputing #pqc

words.filippo.io

A Cryptography Engineer’s Perspective on Quantum Computing Timelines

The risk that cryptographically-relevant quantum computers materialize within the next few years is now high enough to be dispositive, unfortunately.

000

Paul Meyer @katexochen.bsky.social · 07/04/2026

BadAML exploits host-supplied ACPI tables to get arbitrary code execution inside confidential VMs. We reproduced the attack end-to-end against our stack and built an AML sandbox to stop it. katexochen.aro.bz/posts/badaml/ #ConfidentialComputing #Security #Linux

katexochen.aro.bz

Reproducing and mitigating BadAML

BadAML is an attack that exploits host-supplied ACPI tables to gain arbitrary code execution inside confidential VMs, bypassing their memory isolation guarantees. Working on Contrast, we reproduced th...

000

Paul Meyer @katexochen.bsky.social · 31/10/2025

Call for Participation: Nix and NixOS devroom @ FOSDEM 2026 The devroom provides a welcoming space for the Nix community and its extended projects, to give time and space for both technical and non-technical talks about Nix/NixOS. discourse.nixos.org/t/call-for-p... #Nix #NixOS #FOSDEM #fosdem2026

discourse.nixos.org

Call for Participation: Nix and NixOS devroom @ FOSDEM 2026

We are pleased to announce the Nix and NixOS devroom will return for another year at FOSDEM 2026, and with that comes the Call for Participation! The Nix and NixOS devroom aims to provide a welcoming...

041

Reposted by Paul Meyer

NixOS Transylvania Sprint @transylvaniasprint.bsky.social · 23/06/2025

Announcing: Transylvania Sprint - One Week of Nix/OS Hacking Date: October 6-11, 2025 Location: Recenter House, Adrianu Mare, Romania Registration is open! More details at: transylvaniasprint.org #nixos #nix #OpenSource #Hackathon #Romania #Events #Sprint #Transylvania

transylvaniasprint.org

Transylvania Sprint

Nix/OS hackathon in Transylvania, Romania

132

Paul Meyer @katexochen.bsky.social · 24/05/2025

Thanks to all the contributors, and a special shoutout to the release managers Leona Maroni and @thecomputerguy.bsky.social ! I will follow up with a thread focused on the Go ecosystem in some days, so stay tuned! [9/9]

020

Paul Meyer @katexochen.bsky.social · 24/05/2025

'substituteAll' and 'substituteAllFiles' have been deprecated in favor of 'replaceVars' and will be removed in the next release. And I already posted about the improvements of 'lib.packagesFromDirectoryRecursive' being able to construct nested scopes.. [8/x]

110

Paul Meyer @katexochen.bsky.social · 24/05/2025

On the #nixpkgs side of things, the 'no-broken-symlinks hook' was added to catch builds containing dangling or reflexive symlinks, as these are indicative of problems with packaging. The hook can be disabled by providing 'dontCheckForBrokenSymlinks = true;' as an argument to mkDerivation. [7/x]

110

Paul Meyer @katexochen.bsky.social · 24/05/2025

Finally, a NixOS module has been added for ncps, a Nix binary cache proxy service implemented in Go using go-nix. It's available as 'services.ncps.enable'. [6/x]

110

Paul Meyer @katexochen.bsky.social · 24/05/2025

To avoid delaying user logins unnecessarily the multi-user.target is no longer ordered after network-online.target. System services requiring a connection to start correctly must explicitly state so in their service configuration. [5/x]

120

Paul Meyer @katexochen.bsky.social · 24/05/2025

The 'nixos-generate-config' command now supports a optional '--flake' option, which will generate a flake.nix file alongside the configuration.nix and hardware-configuration.nix, providing an easy introduction into flake-based system configurations. [4/x]

110

Paul Meyer @katexochen.bsky.social · 24/05/2025

Next, a 'nixos-rebuild build-image' sub-command has been added. It allows users to build platform-specific (disk) images from their NixOS configurations and works similar to the popular nix-community/nixos-generators project. See new section on image building in the NixOS manual. [3/x]

120

Paul Meyer @katexochen.bsky.social · 24/05/2025

or by adding 'nixos-rebuild-ng' to your 'environment.systemPackages' (for side-by-side installation). It is expected that the next major version of NixOS (25.11) will ship with nixos-rebuild-ng by default. [2/x]

110

Paul Meyer @katexochen.bsky.social · 24/05/2025

Let's take a look at the #NixOS 25.05 release notes. 👀 Starting on the NixOS side of things: nixos-rebuild-ng, a full rewrite of nixos-rebuild in Python, is available for testing. You can enable it by setting 'system.rebuild.enableNg' in your configuration (to replace the old nixos-rebuild), [1/x]

140

Paul Meyer @katexochen.bsky.social · 24/04/2025

SaltSprint, a new NixOS hackathon in Halle (Saale), Germany, announced! From June 30 – July 4, 2025, a week of intense Nix hacking, collaboration, and knowledge sharing in central Germany. saltsprint.org The sprint is hosted by flyingcircus.io. #Nix #NixOS #OpenSource #Hackathon

saltsprint.org

Saltsprint 2025 - One week of NixOS hacking in Halle (Saale)

Develop, learn and grow together with the NixOS community: The Saltsprint in the SaltLabs - organised by the Flying Circus.

030

Paul Meyer @katexochen.bsky.social · 23/04/2025

Some interesting takes by Kelsey on the Nix project at PlanetNix 2025. I hope we can get to a point where commercial and non-commercial interests can co-exist in the project.

100

Paul Meyer @katexochen.bsky.social · 23/04/2025

"You don't have to chase the commercial endeavor, but it may come [...] to you. [...] If you want there to be peace in the project, give people extension points where necessary, so that everything doesn't have to flow into core in order to feel like it's a first class citizen."-@kelseyhightower.com

100