Also, reproducible-builds.org. Arch has most of its packages as reproducible and it integrates into pacman:

https://archlinux.org/packages/community/x86_64/pacman-bintr...

Note, I don't recommend this for haskell packaging on Arch as it slows things down substantially.

For security, you want to only do this with content addressed builds.

We have a company nix cache on S3 overlaid on top of upstream nixpkgs cache where only the CICD is allowed to push/update the cache.

Employee computers are all read-only.

Works great!