3 ms·

Other than the very explicit tracking of the packages, their dependencies, the full build instructions, the public history, cryptographic signatures for the pre

Other than the very explicit tracking of the packages, their dependencies, the full build instructions, the public history, cryptographic signatures for the pre-built binaries, and the trivial ability for anyone to re-build from source and audit the entire chain all the way from bootstrap if they wished? I’m not sure what golden standard we are comparing this to. It is not perfect, but I’d say this is a far more solid bedrock upon which to build software than anything else I’ve encountered.

RaitoBezarius 3y ago
Did you mention sandboxed builds? Actively preventing pip to execute code arbitrarily at install time? Same for Node.js? I cannot live without that anymore, that's the new golden standard.
- tomberek 3y ago
  It’s funny; I forgot to mention sandboxed builds because at this point I’ve forgotten that they are not ubiquitous. Oops. Thanks!
woleium 3y ago
Heh, til. I'll have to take a closer look at the platform. Thank you!
pxc 3y ago
> I’m not sure what golden standard we are comparing this to. There isn't any, of course. But one high standard of excellence that we should celebrate and look up to (or just build upon!) is the Guix full-source bootstrap! They've achieved something pretty incredible in terms of supply chain auditability: https://guix.gnu.org/blog/2023/the-full-source-bootstrap-building-from-source-all-the-way-down/ https://guix.gnu.org/blog/2023/the-full-source-bootstrap-bui... Maybe we could also do more with Trustix, and/or build in something like `guix challenge` to the new Nix CLI, to make verifying package provenance and contents easier for users. > I’d say this is a far more solid bedrock upon which to build software than anything else I’ve encountered. With the exception (in some areas) of our little sister, Guix, absolutely. It's a real relief to have such a predictable, inspectable system as you get on NixOS. The drive for standards like software bills of materials comes from the chaos of the old world, the clumsy ways of building and distributing software, that proper functional package management like Nix obsoletes. (Unfortunately we do still cope with and suffer from those old ways in Nixpkgs where the upstream build systems inflict it on us. The JVM and .NET come to mind.)

RaitoBezarius 3y ago

Did you mention sandboxed builds? Actively preventing pip to execute code arbitrarily at install time? Same for Node.js? I cannot live without that anymore, that's the new golden standard.

tomberek 3y ago
It’s funny; I forgot to mention sandboxed builds because at this point I’ve forgotten that they are not ubiquitous. Oops. Thanks!

woleium 3y ago

Heh, til. I'll have to take a closer look at the platform. Thank you!

pxc 3y ago

> I’m not sure what golden standard we are comparing this to. There isn't any, of course. But one high standard of excellence that we should celebrate and look up to (or just build upon!) is the Guix full-source bootstrap! They've achieved something pretty incredible in terms of supply chain auditability: https://guix.gnu.org/blog/2023/the-full-source-bootstrap-building-from-source-all-the-way-down/ https://guix.gnu.org/blog/2023/the-full-source-bootstrap-bui... Maybe we could also do more with Trustix, and/or build in something like `guix challenge` to the new Nix CLI, to make verifying package provenance and contents easier for users. > I’d say this is a far more solid bedrock upon which to build software than anything else I’ve encountered. With the exception (in some areas) of our little sister, Guix, absolutely. It's a real relief to have such a predictable, inspectable system as you get on NixOS. The drive for standards like software bills of materials comes from the chaos of the old world, the clumsy ways of building and distributing software, that proper functional package management like Nix obsoletes. (Unfortunately we do still cope with and suffer from those old ways in Nixpkgs where the upstream build systems inflict it on us. The JVM and .NET come to mind.)