4 ms·

All true, but I can't not take this opportunity to shill NixOS which has meaningfully addressed many of these issues, and is indeed spending impractical amounts

All true, but I can't not take this opportunity to shill NixOS which has meaningfully addressed many of these issues, and is indeed spending impractical amounts of money storing build outputs ($10k/m). https://discourse.nixos.org/t/the-nixos-foundations-call-to-action-s3-costs-require-community-support/28672 https://discourse.nixos.org/t/the-nixos-foundations-call-to-... It is absolutely better to remove build entropy at the source code stage, but until all software is written that way there are a few build-environment tricks we can use along the way.

zelphirkalt 2y ago
I highly doubt, that we will get anywhere close to developers understanding and valuing reproducibility any time soon. Maybe in 20y or so. Basically outside of the corners like Nix, Guix and maybe a few random people in discussions about issues of package managers, I have not met anyone knowing how to and caring about reproducibility. Meanwhile I enjoy setting up my own GNU Guile projects with a Makefile that sets up a reproducible Guix shell in which my project is run, so that I get the same result on various devices, only needing to issue a single easily memorized or discoverable Makefile target call. Most developers I met don't know how to set something like this up. Provided no one messes with guix package manager commits and guix infrastructure still exists, my projects will run in 10y just like they do today, with reproducible result. Neat. Recently I have taken some time to have this for Ocaml as well. Took some asking on the mailing list, but now works. No need to have anything installed prior to running the Makefile target other than Make and Guix package manager.
- anotherhue 2y ago
  I assume you tried Flakes also? Does Guile have a better approach to this problem (other than the general language difference (everyone hate nix)). Edit: Worth looking at https://github.com/numtide/devshell https://github.com/numtide/devshell
  - zelphirkalt 2y ago
    I have not tried Flakes. Guile's main way of installing packages, I believe, is using Guix package manager. And Guix is written using Guile.
- patrakov 2y ago
  > Basically outside of the corners like Nix, Guix and maybe a few random people in discussions about issues of package managers, I have not met anyone knowing how to and caring about reproducibility. And I did. He was a developer of a purported secure messaging app. The question that changed his mind was: "How are your users, who surely audited your sources and found no trojans hiding there, going to know that you are not distributing trojaned official binary builds?"
- eptcyka 2y ago
  You only have to be burned by an NPM packaging dumpster fire so many times before you start appreciating hermetic builds. Unfortunately, Nix and Guix are trying to work around the issue by warping the whole world around toolchains that were never built with reproducability in mind. So many tool chains just download executables and run them as part of the build process - NPM packages do this, Android app build process does this, Rust packages do this. Turing completeness is too good to give up and gives people the freedom to deploy sloppy solutions.
transpute 2y ago
Does Haskell (used by NixOS) have a fully reproducible build chain?
kpcyrd 2y ago
Arch Linux has .BUILDINFO files embedded in their .pkg.tar.zst files, which references files on https://archive.archlinux.org/ https://archive.archlinux.org/. Debian has .buildinfo files over at https://buildinfos.debian.net/ https://buildinfos.debian.net/ referencing files on https://snapshot.debian.org/ https://snapshot.debian.org/. This is not special to NixOS, documented and archived build environments are an essential part of accomplishing reproducible builds for an operating system.

zelphirkalt 2y ago

I highly doubt, that we will get anywhere close to developers understanding and valuing reproducibility any time soon. Maybe in 20y or so. Basically outside of the corners like Nix, Guix and maybe a few random people in discussions about issues of package managers, I have not met anyone knowing how to and caring about reproducibility. Meanwhile I enjoy setting up my own GNU Guile projects with a Makefile that sets up a reproducible Guix shell in which my project is run, so that I get the same result on various devices, only needing to issue a single easily memorized or discoverable Makefile target call. Most developers I met don't know how to set something like this up. Provided no one messes with guix package manager commits and guix infrastructure still exists, my projects will run in 10y just like they do today, with reproducible result. Neat. Recently I have taken some time to have this for Ocaml as well. Took some asking on the mailing list, but now works. No need to have anything installed prior to running the Makefile target other than Make and Guix package manager.

anotherhue 2y ago
I assume you tried Flakes also? Does Guile have a better approach to this problem (other than the general language difference (everyone hate nix)). Edit: Worth looking at https://github.com/numtide/devshell https://github.com/numtide/devshell
- zelphirkalt 2y ago
  I have not tried Flakes. Guile's main way of installing packages, I believe, is using Guix package manager. And Guix is written using Guile.
patrakov 2y ago
> Basically outside of the corners like Nix, Guix and maybe a few random people in discussions about issues of package managers, I have not met anyone knowing how to and caring about reproducibility. And I did. He was a developer of a purported secure messaging app. The question that changed his mind was: "How are your users, who surely audited your sources and found no trojans hiding there, going to know that you are not distributing trojaned official binary builds?"
eptcyka 2y ago
You only have to be burned by an NPM packaging dumpster fire so many times before you start appreciating hermetic builds. Unfortunately, Nix and Guix are trying to work around the issue by warping the whole world around toolchains that were never built with reproducability in mind. So many tool chains just download executables and run them as part of the build process - NPM packages do this, Android app build process does this, Rust packages do this. Turing completeness is too good to give up and gives people the freedom to deploy sloppy solutions.

transpute 2y ago

Does Haskell (used by NixOS) have a fully reproducible build chain?

kpcyrd 2y ago

Arch Linux has .BUILDINFO files embedded in their .pkg.tar.zst files, which references files on https://archive.archlinux.org/ https://archive.archlinux.org/. Debian has .buildinfo files over at https://buildinfos.debian.net/ https://buildinfos.debian.net/ referencing files on https://snapshot.debian.org/ https://snapshot.debian.org/. This is not special to NixOS, documented and archived build environments are an essential part of accomplishing reproducible builds for an operating system.