The link lists 78 CVEs of varying severity levels opened over a period of 11 years. Many of them are patched. (I don’t know how to easily check how many are patched. The NIST listings provide issue tracker links and severity levels, and the handful of CVEs I looked at had fixes released.) I’m not convinced this is evidence that systemd is unacceptably insecure.
I get that it’s frustrating that systemd has such a broad scope, and that it’s not portable. But these are trade-offs. In exchange we get power that we wouldn’t get otherwise. For example tying device management and scheduled tasks into systemd lets us use the same declarative dependency management in those domains as in the init system. The system is able to bring up services only when needed, boot faster, use fewer resources. The non-portability allows use of, for example, Linux cgroups to cleanly shut down forked processes. Even if we were using an alternative like Upstart I’m gonna guess we would end up relying on cgroups.
Red Hat’s role is certainly something to keep an eye on. But systemd is open source, and it can be forked if necessary.
I sometimes write a flake with those 4 lines of Nix code, and it comes out just messy enough that tbh I’m happier adding an input to handle that. But I recently learned that the nixpkgs flake exports the
lib.*
helpers throughnixpkgs.lib
(as opposed tonixpkgs.legacyPackages.${system}.lib
) so you can call helpers before specifying a system. Andnixpkgs.lib.genAttrs
is kinda close enough toflake-utils.lib.eachSystem
that it might make a better solution.Like where with flake-utils you would write,
flake-utils.lib.eachSystem [ "x86_64-linux" "aarch64-darwin" ] (system: let pkgs = nixpkgs.legacyPackages.${system}; in { devShells.default = pkgs.mkShell { nativeBuildInputs = with pkgs; [ hello ]; }; })
Instead you can use
genAttrs
,let forAllSystems = nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-darwin" ]; pkgs = forAllSystems (system: nixpkgs.legacyPackages.${system} ); in { devShells = forAllSystems (system: { default = pkgs.${system}.mkShell { nativeBuildInputs = with pkgs.${system}; [ hello ]; }; }); }
It’s more verbose, but it makes the structure of outputs more transparent.