Determinate Systems

Bringing Nix ❄️ to the enterprise to empower fearless software delivery 💪

[Determinate Systems @DeterminateSys]

Today we're thrilled to announce the launch of our newest offering: Determinate Secure Packages. A drop-in replacement for Nixpkgs, it offers secure, signed, auditable Nix packages for the enterprise, including CVE monitoring and SLA-backed remediation, per-release SBOMs, optional FIPS-compliant builds, packages cached in FlakeHub Cache, cryptographic signing, and more. Link in thread 🔗🧵👇

[Determinate Systems @DeterminateSys]

Still on NixOS 25.05? Upstream support ended a long time ago, but we've patched eMudhra, PHP, and hundreds of other CVEs. Get critical security patches today without migrating to a new release.

Determinate Secure Packages 25.05 (Emergency Legacy Extension) is available now: https://t.co/zQC9rsBlWX

[Determinate Systems @DeterminateSys]

We've released updates for today's PHP critical remote code execution vulnerabilities to Determinate Secure Packages (including FIPS variants). To be clear, this is in addition to our already-pushed fixes for the eMudhra intermediate CA compromise.

As always, we urge all customers to update their flakes as soon as possible. For more details, see our status page.

https://t.co/86OMVP6VQ9

[Determinate Systems @DeterminateSys]

We're pleased to report that we have pushed fixes for the eMudhra intermediate CA compromise for all distributions of Determinate Secure Packages (including FIPS variants).

We urge all customers to update their flakes as soon as possible. For more details, see our status page.

https://t.co/86OMVP6VQ9

[Determinate Systems @DeterminateSys]

We at Determinate Systems are fully aware of the eMudhra intermediate CA compromise and are moving as quickly as possible to push fixes to all distributions of Determinate Secure Packages ⛔ 🔏

We will notify you here when we have done so, and we advise you to update your flakes ASAP at that time. Until then, we'll push any important updates to our status page.

https://t.co/86OMVP6VQ9

[Determinate Systems @DeterminateSys]

Determinate Nix 3.23.3 is now out 🎉 ❄️ 🚀 and the multi-version changelog for this release covers security fixes for some Nix CVEs, a new feature we're calling "baked flakes," OpenTelemetry tracing, improvements to Wasm support and parallel eval, and so much more.

This is the one you really want, folks. Check out the blog post for a hefty list of recent changes 🔗

https://t.co/QTEWVuRp3S

[Determinate Systems @DeterminateSys]

Great news for people who use Nix on macOS: our Native Linux Builder for Determinate Nix is now officially GA 🎉 🙌 🥳 🍎

That means that you can install Determinate Nix, log into FlakeHub, and immediately start building Linux derivations on macOS, without a request for access. No more remote builders or long-running local VMs, just seamless Linux builds with zero fuss. Read more on our blog 🔗

https://t.co/6jNbKSlECG

[Determinate Systems @DeterminateSys]

You may have seen a recent security advisory for Nix involving CVE-2026-110449, CVE-2026-110450, CVE-2026-110451, and a few others. Providing the most secure Nix possible is a top-line commitment for us, and we're happy to report that these CVEs were fixed in Determinate Nix v3.23.2, released last week. We strongly recommend updating ASAP 🔐 ❄️ 🚀

https://t.co/k4u6kYOEvf

[Determinate Systems @DeterminateSys]

Hold on to your spans, folks, because Determinate Nix can now export OpenTelemetry traces 🔭 ❄️ 🚀

If you have burning questions like "where is Nix spending its time in CI?" you now have a wellspring of data that you can push to Grafana, Datadog, Honeycomb, Jaeger, and many others. Happy observing, Nixers 😎

https://t.co/fes9VcpYKx

[Determinate Systems @DeterminateSys]

We're excited to announce a significant change to our Determinate Secure Packages offering with the introduction of long-term support (LTS). In a nutshell, we've begun to support some distributions for a full 5 years (beginning with 26.05) to better accommodate European CRA and many other use cases 🎉

LTS is available to all current and future customers starting now. Read more in our most recent blog post 🔗 🚀 ❄️

https://t.co/IxlBZbEyUk

[Determinate Systems @DeterminateSys]

If you’re at NixCon 2026 in the lovely Kraków 🇵🇱, we have a booth! Several of us will be camped out here throughout the conference, so don’t hesitate to come say hello and talk anything Nix, supply chain, Linux, and much more.

[Determinate Systems @DeterminateSys]

We’re proud to sponsor NixCon 2026!

Nix has moved well beyond being a powerful tool for individual developers and has become core infrastructure for companies that need software to be reproducible, secure, and reliable everywhere it runs.

At Determinate Systems, we’re building the platform enterprises need to adopt Nix with confidence.

See you in Kraków.

[Determinate Systems @DeterminateSys]

Good news for GitHub Enterprise users: FlakeHub now supports authentication via GitHub Enterprise Managed Users 🔐 🎉

This means that if your org's developers sign into GitHub using an external IdP like Entra ID or Okta or a SAML/SCIM-based solution, they can now log into FlakeHub via that same IdP, providing your org with a crucial identity governance win.

For in-depth details, check out today's blog post ❄️ 🚀 🔗

https://t.co/mER6mI5Hjn

[Determinate Systems @DeterminateSys]

If you're headed to the wonderful Kraków 🇵🇱 for NixCon, come chat with other Nix folks (and us!) at our DetSys Happy Hour on Thursday, September 24th. No agenda, just free drinks and snacks, a lovely venue, and convivial Nix-y times. Register at the link below to find out the place and time 🔗 ❄️ 🚀 🍻

https://t.co/IWTVE90nju

[Determinate Systems @DeterminateSys]

Yesterday, we announced the release of our new CVE remediation dashboard for Determinate Secure Packages 📈 ❄️ 🚀

Take a look if you haven't seen it yet 👀

https://t.co/qwjAF7j8BO

Or if you're interested in a more detailed perspective, this new post on our blog should do the trick 🔗

https://t.co/0hJIm4cUuw

[Determinate Systems @DeterminateSys]

Every CVE we fix for Determinate Secure Packages is now visible on a public dashboard 📊🔒

CVEs can be hard to keep tabs on, so we opted to make our SLAs fully trackable, with critical CVEs fixed within 7 days, high within 15, medium within 45, low within 90, and every tracked vulnerability plotted on a timeline by severity and deadline.

As of today: 988 fixed within SLA in the last 30 days, 84 open and on track, 0 overdue 😊

Come take a look yourself! ❄️ 🚀

https://t.co/2uz9m5aYDk

[Determinate Systems @DeterminateSys]

Determinate Nix 3.22.2 now out! 🎉

We've bumped upstream Nix to 2.35.2 and provided 5-12% faster evaluation with mimalloc, HTTP/3 binary cache fetching, faster `nix copy` in some scenarios, GC roots for `nix eval`, and @Replit auth for FlakeHub. This is the one you really want, folks ❄️ 🚀 🔗

https://t.co/zmRKjJ2mvg

[Determinate Systems @DeterminateSys]

We are proud sponsors of NixCon 2026 and we are excited to see many of you there! Let us know if you are attending using the linked form so you can receive invites to the events we are hosting outside of the conference. More details soon!

https://t.co/OKR0cWHBGQ

[Determinate Systems @DeterminateSys]

Periodic reminder that FlakeHub serves flakes as tarballs from S3, completely independently of GitHub’s infrastructure. This is a great option to consider if you’re looking to harden your Nix workflows against GitHub outages 🔗

https://t.co/l7ldH5yqrc

[Determinate Systems @DeterminateSys]

FlakeHub isn't just easy, secure, and compliant... it's wildy fast, too!

[Graham Christensen @grhmc]

A lot of Nix's performance is down to how fast your binary cache can issue a 404. FlakeHub's P99 for cache misses is below 1ms.

Our geographically distributed network means low round-trip latency, too.

Really amazing what this team has built.

[Determinate Systems @DeterminateSys]

The EU Cyber Resilience Act's first deadline is coming up on September 11 🇪🇺 From that date, you'll have just 24 hours to report an actively exploited vulnerability 📋

But don't fret! Determinate Systems is here to provide answers. Check out our latest blog post to see how Determinate Secure Packages, FlakeBOM, and FlakeAudit provide the SLA-backed CVE remediation, SBOMs, and CI gates that will enable you to get well out in front of these impending requirements 🔗 🚀

https://t.co/ObqPjvEIZz