3 ms·

Nix derivations are not actually content addressable, at least not yet. Derivations are input addressed. That means that the only way to validate the contents

Nix derivations are not actually content addressable, at least not yet. Derivations are input addressed. That means that the only way to validate the contents would be to take all the inputs and build the derivation yourself, defeating the purpose of using the cache. That means that nix caches must be trusted to not be malicious, with no computationally efficient way to protect against cache poisoning. There is a project underway to transition the nix store to be content addressable, which will decouple trust from distribution.

k__ 3y ago
Interesting! I always had the impression that derivations being content addressable was one of Nix' main selling points. For reproducibility etc.
thomastjeffery 3y ago
When that work is done, will it be a strong enough guarantee to use instead of just gpg-signing derivations? The father I dive into Nix, the more I get the feeling that nixpkgs is only half of a package manager; and that the other half has been perpetually put on hold, while we wait for the eventual perfect implementation of Nix to make that half implicitly obsolete. The more I use Nix (especially NixOS), the more I feel like that second half of the package manager is precisely what I am missing. Even when it it's obsoleted by guaranteed reproduciblity, I may still find value in it. I would love to have a nix store that accommodates traditional gpg-signed packages. The usefulness of that would extend beyond Nix and nixpkgs.
- hamandcheese 3y ago
  > When that work is done, will it be a strong enough guarantee to use instead of just gpg-signing derivations? Derivations can be signed already, and are signed in the official cache I believe. You can configure which keys to trust. In that sense, it think it is possible to mirror the official cache.
Ericson2314 3y ago
derivations are build plans. derivation outputs you mean. derivations are always content-addressed. derivations outputs can be input-addressed or content-addressed, but the latter is still an experimental feature.
tjoff 3y ago
You don't have to do it yourself. Someone you trust need to do it, but the distribution itself don't need to be trusted.

k__ 3y ago

Interesting! I always had the impression that derivations being content addressable was one of Nix' main selling points. For reproducibility etc.

thomastjeffery 3y ago

When that work is done, will it be a strong enough guarantee to use instead of just gpg-signing derivations? The father I dive into Nix, the more I get the feeling that nixpkgs is only half of a package manager; and that the other half has been perpetually put on hold, while we wait for the eventual perfect implementation of Nix to make that half implicitly obsolete. The more I use Nix (especially NixOS), the more I feel like that second half of the package manager is precisely what I am missing. Even when it it's obsoleted by guaranteed reproduciblity, I may still find value in it. I would love to have a nix store that accommodates traditional gpg-signed packages. The usefulness of that would extend beyond Nix and nixpkgs.

hamandcheese 3y ago
> When that work is done, will it be a strong enough guarantee to use instead of just gpg-signing derivations? Derivations can be signed already, and are signed in the official cache I believe. You can configure which keys to trust. In that sense, it think it is possible to mirror the official cache.

Ericson2314 3y ago

derivations are build plans. derivation outputs you mean. derivations are always content-addressed. derivations outputs can be input-addressed or content-addressed, but the latter is still an experimental feature.

tjoff 3y ago

You don't have to do it yourself. Someone you trust need to do it, but the distribution itself don't need to be trusted.