i assume it does not have the same goals wrt hermeticity as nix?
Correct, for the most part it uses the binaries distributed by the upstream project.