From 305a0e61f839de12f5aebaee6e1469e138c86fd7 Mon Sep 17 00:00:00 2001 From: "Simen A. W. Olsen" Date: Tue, 27 Oct 2026 11:50:21 +0100 Subject: feat: gate updates behind vet supply-chain checks update now holds inputs and skills back by a cooldown, has Claude review third-party diffs, and reports CVE changes before switching. Homebrew taps are pinned through nix-homebrew, and npm/pnpm get install policies. --- README.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'README.md') diff --git a/README.md b/README.md index dbca951..b8f3adc 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ My Development Setup, managed with [Nix](https://nixos.org), [nix-darwin](https: ## Quickstart Setting up a new machine? Follow [INSTALL.md](INSTALL.md) — it covers the -prerequisites (Homebrew, App Store, 1Password SSH agent) that the commands below +prerequisites (Nix, App Store, 1Password SSH agent) that the commands below assume are already in place. ### 1. Install Determinate Nix @@ -63,6 +63,7 @@ home-manager switch --flake .#simenandre@aarch64-linux ``` flake.nix # Entry point – inputs & all configurations +vet.json # Cooldown and own/trusted sources for vet INSTALL.md # Full setup guide for a new machine hosts/ nixbox/ @@ -77,6 +78,7 @@ modules/ claude.nix # Claude Code instructions and skills git.nix # Git configuration (platform-aware SSH signing path) zsh.nix # Zsh configuration (zshenv, zshrc, aliases, path, completions) + supply-chain.nix # npm/pnpm install policy, osv-scanner starship.nix # Starship prompt tmux.nix # Tmux configuration lazygit.nix # Lazygit configuration @@ -84,6 +86,8 @@ modules/ ghostty.nix # Ghostty terminal configuration nixos/ default.nix # NixOS system configuration +pkgs/ + vet/ # Cooldown and Claude review gate for `update` scripts/ cleanup.sh # macOS cleanup utility ``` -- cgit v1.3.1