> Either we can build everything from source, so that we have reproducibility (see e.g. emerge for a practical system, although it is still not bit-for-bit repr

> Either we can build everything from source, so that we have reproducibility (see e.g. emerge for a practical system, although it is still not bit-for-bit reproducible) or else we can ship everything as a blob so we have total consistency (e.g. Docker, Go). Nix is really both of these combined, and is not like apt/dpkg in how it separates source and binary packages. A Nix package is really instructions (including all compiler flags) of how to build something from source [1] and nothing more. Due to being pure functions, given the binary inputs (e.g. a zlib dependency previously built) and the instructions, any two people will always get the same binary output upon executing those instructions [2]. Furthermore, without executing the instructions, I can generate the unique identifier of the resulting binary package by hashing the inputs and the instructions. This unique identifier can be used to determine if the package already exists locally in /nix/store, and optionally be used to check if some trusted binary cache (such as Nix's binary cache) already has the binary package. There is no binary package in the sense that apt/dpkg have source packages and many derived binary packages which are installed without need of the source package. For example (contrived and simplified): gcc-uniqueGccHash = bootstrappingProblem() libc-uniqueLibcHash = buildLibc(gcc-uniqueGccHash) zlib-uniqueZlibHash = buildZlib(gcc..., libc...) myprog-uniqueMyProgHash = buildMyProg(gcc..., libc..., zlib...) To download "myprog" from a binary cache, I can't calculate uniqueMyProgHash using any old versions of libc and zlib; I must have exactly the same hashes that were used by the system that built "myprog", all the way up the dependency chain. And I'll only ever have that if the builds are reproducible and/or I downloaded them all from the same binary cache. [1] In practice, there's nothing stopping the instructions from saying "download this binary blob" instead of "download this source tarball". [2] The problem of build reproduciblity is not solved, but many outside of Nix also see this as important, see https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds