6 ms·

I thought NixOS solves the full reproducibility problem really well already. https://nixos.org https://nixos.org

by nikivi 8y ago

Foxboron 8y ago
It doesn't. NixOS doesn't do reproducible builds, it does reproducible systems. Reproducible builds is essentially about compiling source code to a binary and always get the same checksum Reproducible systems is about always getting the same system/behavior given the same configuration. Which is what NixOS does.
- nikivi 8y ago
  I thought that getting the same system/behavior would require reproducible builds too. Perhaps I am wrong.
  - vertex-four 8y ago
    The same behaviour can come out of different binaries - the issue that reproducible builds is solving isn’t that programs have different behaviour from compile to compile, it’s that people can’t prove they were compiled correctly.
  - black_puppydog 8y ago
    If your build process always produces the exact same binaries, and you always use the exact same environment to run these, then yes, that's reproducible. It's not equivalent though, in that you can easily have a system that always exhibits the same behaviour (what NixOS does) but does not use bit-by-bit equal binaries. For example, some symbols in some library's .so file might be in a different order, or some padding bits that are never read might be zero or random depending on your compiler's choice.
- aseipp 8y ago
  We did have a bunch of patches to actually make a lot of builds reproducible, but integrating changes like that has been pretty slow. I'm pretty sure a lot of these patches have since been adopted, pulling things much closer to bit-by-bit reproducible. Unfortunately there's no real metric we have to keep track of that at the moment, like Debian ("%XY.Z are working"). But it looks like basically all distros are finally starting to converge on this.
  - Foxboron 8y ago
    There was no intentions to claim you where not working towards reproducible builds. I have come across several people that conflate what NixOS offers, and what reproducible builds are. However, great that you have been working towards this! Arch Linux has been cooperating with Debian and currently build our packages on their infrastructure to produce graphs and test our packages. I assume NixOS can do the same thing if the manpower is present. https://tests.reproducible-builds.org/archlinux/archlinux.html https://tests.reproducible-builds.org/archlinux/archlinux.ht...
yc-kraln 8y ago
Did you read the article? It's about Debian, and it explicitly mentions NixOS. It also mentions certain packages (Emacs, certain secure boot stuff) which at the moment are not reproducible.
chriswarbo 8y ago
Nix doesn't "solve" reproducibility. For example, if the thing being packaged builds non-deterministically (e.g. if components are built concurrently, and added to a tarball in whichever order they finish). Nix can make it easier to avoid introducing new problems, and it also gives an audit trail of which versions of things were used to build things. Also Debian doesn't use Nix, so that wouldn't solve the problem for Debian. Nix (along with everyone else) does benefit from the improvements that Debian is making, e.g. finding non-determinism in programs and getting it fixed upstream.

I thought NixOS solves the full reproducibility problem really well already. https://nixos.org https://nixos.org

by nikivi 8y ago

I thought NixOS solves the full reproducibility problem really well already. https://nixos.org https://nixos.org

It doesn't. NixOS doesn't do reproducible builds, it does reproducible systems. Reproducible builds is essentially about compiling source code to a binary and always get the same checksum Reproducible systems is about always getting the same system/behavior given the same configuration. Which is what NixOS does.

nikivi 8y ago
I thought that getting the same system/behavior would require reproducible builds too. Perhaps I am wrong.
- vertex-four 8y ago
  The same behaviour can come out of different binaries - the issue that reproducible builds is solving isn’t that programs have different behaviour from compile to compile, it’s that people can’t prove they were compiled correctly.
- black_puppydog 8y ago
  If your build process always produces the exact same binaries, and you always use the exact same environment to run these, then yes, that's reproducible. It's not equivalent though, in that you can easily have a system that always exhibits the same behaviour (what NixOS does) but does not use bit-by-bit equal binaries. For example, some symbols in some library's .so file might be in a different order, or some padding bits that are never read might be zero or random depending on your compiler's choice.
aseipp 8y ago
We did have a bunch of patches to actually make a lot of builds reproducible, but integrating changes like that has been pretty slow. I'm pretty sure a lot of these patches have since been adopted, pulling things much closer to bit-by-bit reproducible. Unfortunately there's no real metric we have to keep track of that at the moment, like Debian ("%XY.Z are working"). But it looks like basically all distros are finally starting to converge on this.
- Foxboron 8y ago
  There was no intentions to claim you where not working towards reproducible builds. I have come across several people that conflate what NixOS offers, and what reproducible builds are. However, great that you have been working towards this! Arch Linux has been cooperating with Debian and currently build our packages on their infrastructure to produce graphs and test our packages. I assume NixOS can do the same thing if the manpower is present. https://tests.reproducible-builds.org/archlinux/archlinux.html https://tests.reproducible-builds.org/archlinux/archlinux.ht...

yc-kraln 8y ago

Did you read the article? It's about Debian, and it explicitly mentions NixOS. It also mentions certain packages (Emacs, certain secure boot stuff) which at the moment are not reproducible.

chriswarbo 8y ago

Nix doesn't "solve" reproducibility. For example, if the thing being packaged builds non-deterministically (e.g. if components are built concurrently, and added to a tarball in whichever order they finish). Nix can make it easier to avoid introducing new problems, and it also gives an audit trail of which versions of things were used to build things. Also Debian doesn't use Nix, so that wouldn't solve the problem for Debian. Nix (along with everyone else) does benefit from the improvements that Debian is making, e.g. finding non-determinism in programs and getting it fixed upstream.