A supply-chain attack on Nix, and our approach to solving it.