> 1. If nix fails to pull anything, it builds (up to and including Linux kernel and compiler).

If nix fails to pull things from its binary cache, it will download the "sources" of the derivations, which are hosted in various places and so it's even more likely an overly broad block impacts one of them.

This football block very well could also cover GitHub, cdn.kernel.org, and so on, so nix building things could fail just as easily.

The solution isn't to use something else which can download source code from 100s of sites across the internet to compile as a fallback, it's to not use internet which sporadically blocks sites hosting developer assets.

The solution is not technical, it's political.

1. We are more on OCI images? Assuming source available, run nix build and docker load of result.

2. Even if kernel.org or GitHub.com will be blocked, it likely than not it already was cached by nixos org cache or community cache or cachix or by your CI or by you workstation.