Nix flake for the oso packages.
Currently the following oso packages are provided as flake package outputs:
The oso cloud cli binary is downloaded from the d3i4cc4dqewpo9.cloudfront.net domain which is listed in this installation script linked on their documentation site here. As you can see, the url is kind of weird and dynamic looking and could be changed at some point in the future for all I know. If that happens and this script isn't updated accordingly an attacker could use this domain to supply a malicious binary to the users of this flake.
Now the sha256 hashes matched in the flake do prevent that hypothetical scenario but this warning is being listed here just in case.