aboutsummaryrefslogtreecommitdiffstats
path: root/modules/darwin/default.nix
diff options
context:
space:
mode:
authorSimen A. W. Olsen <hello@simenandre.no>2026-10-27 11:50:21 +0100
committerSimen A. W. Olsen <hello@simenandre.no>2026-10-27 11:50:21 +0100
commit305a0e61f839de12f5aebaee6e1469e138c86fd7 (patch)
treec3c7ff3dd1180a785e02a848ad3e4655d68cea20 /modules/darwin/default.nix
parent163c2dee18ab2b197fe1fcf00cf32214b804fda6 (diff)
downloaddotfiles-305a0e61f839de12f5aebaee6e1469e138c86fd7.tar.gz
dotfiles-305a0e61f839de12f5aebaee6e1469e138c86fd7.zip
feat: gate updates behind vet supply-chain checksHEADmain
update now holds inputs and skills back by a cooldown, has Claude review third-party diffs, and reports CVE changes before switching. Homebrew taps are pinned through nix-homebrew, and npm/pnpm get install policies.
Diffstat (limited to 'modules/darwin/default.nix')
-rw-r--r--modules/darwin/default.nix4
1 files changed, 4 insertions, 0 deletions
diff --git a/modules/darwin/default.nix b/modules/darwin/default.nix
index d23e795..1ccb7c9 100644
--- a/modules/darwin/default.nix
+++ b/modules/darwin/default.nix
@@ -144,5 +144,9 @@
# Specific toolsets
rclone
+
+ # Supply-chain checks: vet gates `update`, nvd shows what a switch changes
+ (pkgs.callPackage ../../pkgs/vet { })
+ nvd
];
}