4 ms·

Nix/Guix are quite cool to tackle this. They are progressing quite quickly towards reproducible builds, so you can avoid compromised servers sending malicious

by nextos 7y ago

Nix/Guix are quite cool to tackle this. They are progressing quite quickly towards reproducible builds, so you can avoid compromised servers sending malicious binaries. Also, since package definitions are quite declarative, I guess it's easier to perform static verification to spot malicious code getting introduced there. There's e.g. Vulnix that scans for CVEs [1]. [1] https://github.com/flyingcircusio/vulnix https://github.com/flyingcircusio/vulnix

swdunlop 7y ago
NixOS (and NixPkgs) is great, but there are still plenty of binary only packages from difficult to build projects like PhantomJS in the ecosystem. It takes a serious commitment to build complex projects in Nix and maintain them. (edit) An example of binary packages in Nixpkgs: https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/tools/phantomjs/default.nix https://github.com/NixOS/nixpkgs/blob/master/pkgs/developmen...
- baroffoos 7y ago
  Should you really be installing programs that are impossible to build? Also phantomjs is discontinued.
  - swdunlop 7y ago
    That's a great question, but it does not invalidate the point that there is nothing about Nix that states that binary packages cannot and do not happen.
    - nextos 7y ago
      Try for example FHS environments. That should make it possible to install software in a conventional way.
- nextos 7y ago
  You can also build regular packages, no matter how complicated they are, by spanning an FHS environment. That's sort of a sandbox that simulates a regular Unix environment with whatever dependencies you need in the usual places (/bin, /usr, ...). Of course, you loose some Nix advantages. But it's a great way to get a regular Unix environment for one-off things or desperate cases.
wwright 7y ago
I believe they aren’t just progressing towards reproducible builds, but that the whole system is already predicated on them. In Nix, you have to make special exceptions for packages that aren’t rebuildable from source.
- deleted 7y ago
  [deleted]
- svd4anything 7y ago
  Rebuildable is different than reproducible. The Nix system is predicated on rebuilding. Ideally the binaries would be all also reproducible however it turns out making compilation completely deterministic is actually pretty hard. When we reach that point and me and you can both independently produce identical binaries and hash them from exactly the same source code that is beyond fantastic for security and auditing.
  - delroth 7y ago
    r13y.com tracks the progress for NixOS reproducibility (well, for the tiny subset of nixpkgs that forms the minimal ISO image at least).

by nextos 7y ago

swdunlop 7y ago

NixOS (and NixPkgs) is great, but there are still plenty of binary only packages from difficult to build projects like PhantomJS in the ecosystem. It takes a serious commitment to build complex projects in Nix and maintain them. (edit) An example of binary packages in Nixpkgs: https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/tools/phantomjs/default.nix https://github.com/NixOS/nixpkgs/blob/master/pkgs/developmen...

baroffoos 7y ago
Should you really be installing programs that are impossible to build? Also phantomjs is discontinued.
- swdunlop 7y ago
  That's a great question, but it does not invalidate the point that there is nothing about Nix that states that binary packages cannot and do not happen.
  - nextos 7y ago
    Try for example FHS environments. That should make it possible to install software in a conventional way.
nextos 7y ago
You can also build regular packages, no matter how complicated they are, by spanning an FHS environment. That's sort of a sandbox that simulates a regular Unix environment with whatever dependencies you need in the usual places (/bin, /usr, ...). Of course, you loose some Nix advantages. But it's a great way to get a regular Unix environment for one-off things or desperate cases.

wwright 7y ago

I believe they aren’t just progressing towards reproducible builds, but that the whole system is already predicated on them. In Nix, you have to make special exceptions for packages that aren’t rebuildable from source.

deleted 7y ago
[deleted]
svd4anything 7y ago
Rebuildable is different than reproducible. The Nix system is predicated on rebuilding. Ideally the binaries would be all also reproducible however it turns out making compilation completely deterministic is actually pretty hard. When we reach that point and me and you can both independently produce identical binaries and hash them from exactly the same source code that is beyond fantastic for security and auditing.
- delroth 7y ago
  r13y.com tracks the progress for NixOS reproducibility (well, for the tiny subset of nixpkgs that forms the minimal ISO image at least).