Martin Schwaighofer works at the intersection between Nix and supply chain security, trying to prove the link between source code and output artifacts.