From 305a0e61f839de12f5aebaee6e1469e138c86fd7 Mon Sep 17 00:00:00 2001
From: "Simen A. W. Olsen" <hello@simenandre.no>
Date: Tue, 27 Oct 2026 11:50:21 +0100
Subject: feat: gate updates behind vet supply-chain checks

update now holds inputs and skills back by a cooldown, has Claude review
third-party diffs, and reports CVE changes before switching. Homebrew taps
are pinned through nix-homebrew, and npm/pnpm get install policies.
---
 modules/home/default.nix      |  1 +
 modules/home/supply-chain.nix | 26 ++++++++++++++++++++++++++
 modules/home/zsh.nix          | 28 ++++++++++++++++++++++------
 3 files changed, 49 insertions(+), 6 deletions(-)
 create mode 100644 modules/home/supply-chain.nix

(limited to 'modules/home')

diff --git a/modules/home/default.nix b/modules/home/default.nix
index 5331684..e815c7c 100644
--- a/modules/home/default.nix
+++ b/modules/home/default.nix
@@ -10,6 +10,7 @@
     ./herdr.nix
     ./onepassword.nix
     ./starship.nix
+    ./supply-chain.nix
     ./tmux.nix
     ./lazygit.nix
     ./twm.nix
diff --git a/modules/home/supply-chain.nix b/modules/home/supply-chain.nix
new file mode 100644
index 0000000..43c5f3b
--- /dev/null
+++ b/modules/home/supply-chain.nix
@@ -0,0 +1,26 @@
+{ pkgs, lib, ... }:
+
+let
+  # Most registry compromises are caught and unpublished within days, so a
+  # week-old version has had time to be noticed. Lifecycle scripts are
+  # already blocked by pnpm unless a project allows them.
+  pnpmConfig = ''
+    minimumReleaseAge: 10080
+    trustPolicy: no-downgrade
+    blockExoticSubdeps: true
+  '';
+in
+{
+  # pnpm reads $XDG_CONFIG_HOME/pnpm/config.yaml, and on macOS falls back to
+  # ~/Library/Preferences/pnpm when XDG_CONFIG_HOME is unset (GUI apps, editors).
+  xdg.configFile."pnpm/config.yaml".text = pnpmConfig;
+  home.file."Library/Preferences/pnpm/config.yaml" = lib.mkIf pkgs.stdenv.isDarwin {
+    text = pnpmConfig;
+  };
+
+  # An env var rather than ~/.npmrc, which `npm login` must be able to write.
+  # pnpm ignores it. Explicit `npm run <script>` still runs.
+  home.sessionVariables.npm_config_ignore_scripts = "true";
+
+  home.packages = [ pkgs.osv-scanner ];
+}
diff --git a/modules/home/zsh.nix b/modules/home/zsh.nix
index 3cef29d..88873d8 100644
--- a/modules/home/zsh.nix
+++ b/modules/home/zsh.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, flakeAttr, ... }:
+{ config, pkgs, lib, flakeAttr, ... }:
 
 let
   # Pinned to commits, not branch names: a branch ref keeps moving while the
@@ -40,6 +40,9 @@ in
       export XDG_CACHE_HOME=''${XDG_CACHE_HOME:-$HOME/.cache}
       export ZDOTDIR=''${ZDOTDIR:-$XDG_CONFIG_HOME/zsh}
 
+      # home.sessionVariables (GOPRIVATE, SKILLS_MANAGED_BY, ...)
+      . "${config.home.profileDirectory}/etc/profile.d/hm-session-vars.sh"
+
       # Ensure path arrays do not contain duplicates.
       typeset -gU path fpath
 
@@ -120,13 +123,26 @@ in
       alias tailscale='/Applications/Tailscale.app/Contents/MacOS/Tailscale'
       alias rebuild='sudo darwin-rebuild switch --flake ~/ghq/simenandre.no/dotfiles#${flakeAttr}'
       function update() {
-        local flake=~/ghq/simenandre.no/dotfiles
-        nix flake update --flake "$flake" || return
+        local flake=~/ghq/simenandre.no/dotfiles out
+        out=$(mktemp -d)
+        # vet holds inputs back by a cooldown and has Claude review third-party
+        # changes; see pkgs/vet.
+        (cd "$flake" && vet lock && vet check --report "$out/report") || {
+          echo 'update: stopped by vet, nothing was switched'
+          return 1
+        }
+        (cd "$out" && darwin-rebuild build --flake "$flake#${flakeAttr}") || return
+        nvd diff /run/current-system "$out/result"
+        (cd "$flake" && vet cves /run/current-system "$out/result" --report "$out/cves") ||
+          { echo 'update: CVE scan failed'; : >"$out/cves"; }
+        read -q '?update: switch to this system? [y/N] ' || { echo; return 1; }
+        echo
         sudo darwin-rebuild switch --flake "$flake#${flakeAttr}" || return
-        # Commit only after a switch succeeds, and only flake.lock, so unrelated
+        # Commit only after a switch succeeds, and only the locks, so unrelated
         # work in the tree stays uncommitted.
-        git -C "$flake" diff --quiet HEAD -- flake.lock && return 0
-        git -C "$flake" commit -m 'chore(flake): update inputs' -- flake.lock || return
+        git -C "$flake" diff --quiet HEAD -- flake.lock skills.lock && return 0
+        printf 'chore(flake): update inputs\n\n%s\n\n%s\n' "$(<"$out/report")" "$(<"$out/cves")" |
+          git -C "$flake" commit -F - -- flake.lock skills.lock || return
         git -C "$flake" push || echo 'update: lock committed but push failed'
       }
       alias nix-gc='sudo nix-collect-garbage --delete-older-than 14d && nix-collect-garbage --delete-older-than 14d && nix store gc'
-- 
cgit v1.3.1