Post by gamesdroides about Nosana token ($NOS)

$NOS I found a reproducibility and supply-chain issue in Nosana's official Ollama example. The job downloads command.sh at runtime from raw.githubusercontent.com/KeesGeerligs/nosana/main/benchmarking/images/command.sh, makes it executable, and runs it immediately. Because it follows mutable main and no commit or checksum is pinned, the same ollama.json can execute different code over time without the job definition changing.

Suggestion: move the script to a Nosana-owned repo or image and pin an immutable commit or image digest. Better still, vendor the script into the container or verify a SHA-256 before execution. That would make the example reproducible and auditable.

Question: is the KeesGeerligs/nosana personal repo intended as a permanent production dependency, or is it leftover from benchmarking?