This could be improved by follow what nix does: pull all dependencies first and then execute the build in a container or namespace without any access to the network.

Misuse/Overuse of the word "federated" is apparently all the rage in 2023.

This had to happen. Most build-scripts could run on wasm, and the others should have to be manually approved before being executed