laut signature format

laut is a proposed new, extensible signature format for Nix, a build system that builds software in isolated steps with precisely recorded inputs, and distributes the results through shared caches. People increasingly turn to Nix for its supply chain security properties, but it arguably does not yet live up to that promise. A finished package is the end of a long chain of build steps, yet an existing Nix signature just links the original recipe to the final output. That is no different from how software supply chains have always worked: we trust the place a binary came from with how it was produced, so anyone using a cache implicitly trusts whoever that cache trusts, not knowing who that is. With laut, every builder signs who they are, and exactly which inputs went into a build step and which outputs came out; these statements link up: a verifier can follow the chain from the original sources to the finished package and check it against their own trust model, for example requiring that two independent builders produced the same result. This project will polish laut from a research prototype into a standalone tool ready for users and contributors, and work towards signatures being produced and shared via infrastructure like cache.nixos.org, to support wide adoption.