4 ms·

How so? You can see the build as a pure function. It consumes a binary blob but it doesn't make it any less deterministic?

by tener 10y ago

davexunit 10y ago
The build is a source to binary function. How does one reproduce the binary blob? How does one know that binary hasn't been tampered with?
- qwertyuiop924 10y ago
  Checksums!
  - davexunit 10y ago
    You're missing the point.
    - qwertyuiop924 10y ago
      Well, yes, but I read some newer comments, and I get what you mean. I don't necesarily agree with your decision, but I understand it. M-x passive-agressive-mode And now, I'll go upgrade my NVIDIA drivers, and load up Psychonauts on Steam.
- corysama 10y ago
  How does one reproduce a .c file? By copying the file. Either way, you know the bits of both the .c and the .so have not been tampered with because you can verify their hashes. Again, it's a philosophical distinction, not a technical one.
  - davexunit 10y ago
    It is both a technical and social problem. Please read: https://reproducible-builds.org/ https://reproducible-builds.org/
    - corysama 10y ago
      The title of that project is "Reproducible Builds". But, that is only a step towards their goal of "Verifiable Builds". Thus we end up in this frustrating semantic mismatch between the two of us. Guix demands source-verifiable builds. Nix does not. Both enable reproducible builds equally well.
- tener 10y ago
  And how do you know the source code hasn't been tampered with? The same way: cryptographic signatures and checksums.
- fizzbatter 10y ago
  Can't trust the source either, if you're worried about it being tampered with right? At some point you have to trust something, likely from a central location.. either a checksum, blob, source, or etc.
chriswarbo 10y ago
Yes, using binaries is a different issue to software freedom. For example, the Haskell toolchain in nixpkgs downloads pre-compiled binaries of old GHC versions (7.0.4 and 7.4.2) which it uses to bootstrap the newer versions. The binaries are checksummed to ensure reproducibility.

How so? You can see the build as a pure function. It consumes a binary blob but it doesn't make it any less deterministic?

by tener 10y ago

How so? You can see the build as a pure function. It consumes a binary blob but it doesn't make it any less deterministic?

davexunit 10y ago

The build is a source to binary function. How does one reproduce the binary blob? How does one know that binary hasn't been tampered with?

qwertyuiop924 10y ago
Checksums!
- davexunit 10y ago
  You're missing the point.
  - qwertyuiop924 10y ago
    Well, yes, but I read some newer comments, and I get what you mean. I don't necesarily agree with your decision, but I understand it. M-x passive-agressive-mode And now, I'll go upgrade my NVIDIA drivers, and load up Psychonauts on Steam.
corysama 10y ago
How does one reproduce a .c file? By copying the file. Either way, you know the bits of both the .c and the .so have not been tampered with because you can verify their hashes. Again, it's a philosophical distinction, not a technical one.
- davexunit 10y ago
  It is both a technical and social problem. Please read: https://reproducible-builds.org/ https://reproducible-builds.org/
  - corysama 10y ago
    The title of that project is "Reproducible Builds". But, that is only a step towards their goal of "Verifiable Builds". Thus we end up in this frustrating semantic mismatch between the two of us. Guix demands source-verifiable builds. Nix does not. Both enable reproducible builds equally well.
tener 10y ago
And how do you know the source code hasn't been tampered with? The same way: cryptographic signatures and checksums.
fizzbatter 10y ago
Can't trust the source either, if you're worried about it being tampered with right? At some point you have to trust something, likely from a central location.. either a checksum, blob, source, or etc.

chriswarbo 10y ago

Yes, using binaries is a different issue to software freedom. For example, the Haskell toolchain in nixpkgs downloads pre-compiled binaries of old GHC versions (7.0.4 and 7.4.2) which it uses to bootstrap the newer versions. The binaries are checksummed to ensure reproducibility.