5 ms·

One thing that Yocto (and buildroot) do really well is reproducibility. When building Debian/Ubuntu based firmware, you don't really know what package versions

One thing that Yocto (and buildroot) do really well is reproducibility. When building Debian/Ubuntu based firmware, you don't really know what package versions you'll get unless you are mirroring the package tree yourself. If you don't, then any build-flow that involves apt-upgrading or apt-installing packages (yes, even Docker builds) has no guarantee that you'll get an equivalent result if you rerun it 3 months later.

haolez 3y ago
That's funny because I'm working on a Yocto project and I'm thinking of porting it to Nix.
- nrclark 3y ago
  If you do, I'd love to hear a follow-up on how it goes. I keep meaning to try that out myself. If you remember later, shoot me an email at nicholas-replace-with-dot-clark at gmaildotcom
binwiederhier 3y ago
If you mirror and snapshot the package repo you can get reproducible-ish builds. We have done this at very large scale at $job, see my post here: https://blog.heckel.io/2019/09/18/image-based-upgrades-upgrading-software-and-os-of-80k-servers-every-two-weeks/ https://blog.heckel.io/2019/09/18/image-based-upgrades-upgra...
fweimer 3y ago
Debian stable also aims for equivalent results. But you are right that they might not be the same under a particular definition of reproducibility. In general, once you have a build environment that is actively maintain (to fix important bugs and security vulnerabilities), it will approach Debian stable to some degree, in the sense that developers get updates they did not request (so that they stop baking in known and fixed vulnerabilities into their applications).
Denvercoder9 3y ago
> any build-flow that involves apt-upgrading or apt-installing packages (yes, even Docker builds) has no guarantee that you'll get an equivalent result if you rerun it 3 months later. You can ask `apt` to install specific versions of packages. You do have to provide a repository that contains old versions though, e.g. Debian's snapshot archive: https://snapshot.debian.org/ https://snapshot.debian.org/

haolez 3y ago

That's funny because I'm working on a Yocto project and I'm thinking of porting it to Nix.

nrclark 3y ago
If you do, I'd love to hear a follow-up on how it goes. I keep meaning to try that out myself. If you remember later, shoot me an email at nicholas-replace-with-dot-clark at gmaildotcom

binwiederhier 3y ago

If you mirror and snapshot the package repo you can get reproducible-ish builds. We have done this at very large scale at $job, see my post here: https://blog.heckel.io/2019/09/18/image-based-upgrades-upgrading-software-and-os-of-80k-servers-every-two-weeks/ https://blog.heckel.io/2019/09/18/image-based-upgrades-upgra...

fweimer 3y ago

Debian stable also aims for equivalent results. But you are right that they might not be the same under a particular definition of reproducibility. In general, once you have a build environment that is actively maintain (to fix important bugs and security vulnerabilities), it will approach Debian stable to some degree, in the sense that developers get updates they did not request (so that they stop baking in known and fixed vulnerabilities into their applications).

Denvercoder9 3y ago

> any build-flow that involves apt-upgrading or apt-installing packages (yes, even Docker builds) has no guarantee that you'll get an equivalent result if you rerun it 3 months later. You can ask `apt` to install specific versions of packages. You do have to provide a repository that contains old versions though, e.g. Debian's snapshot archive: https://snapshot.debian.org/ https://snapshot.debian.org/