5 ms·

Contrary to popular opinion, Nix builds aren't reproducible: https://luj.fr/blog/is-nixos-truly-reproducible.html https://luj.fr/blog/is-nixos-truly-reproducibl

by lima 1y ago

Contrary to popular opinion, Nix builds aren't reproducible: https://luj.fr/blog/is-nixos-truly-reproducible.html https://luj.fr/blog/is-nixos-truly-reproducible.html

pxc 1y ago
That's such a weird characterization of this article, which (in contrast to other writing on this subject) clearly concludes (a) that Nix achieves a very high degree of reproducibility and is continuously improving in this respect, and (b) Nix is moreover reproducible in a way that most other distros (even distros that do well in some measures of bitwise reproducibility) are not (namely, time traveling— being able to reproduce builds in different environments, even months or years later, because the build environment itself is more reproducible). The article you linked is very clear that both qualitatively and quantitatively, NixOS has made achieved high degrees of reproducibility, and even explicitly rejects the possibility of assessing absolute reproducibility. NixOS may not be the absolute leader here (that's probably stagex, or GuixSD if you limit yourself to more practical distros with large package collections), but it is indeed very good. Did you mean to link to a different article?
- looofooo0 1y ago
  What does high degree mean? Either you achieve bit for bit reproducibility of your builds or not.
  - kfajdsl 1y ago
    If 99% of the packages in your repos are bit-for-bit reproducible, you can consider your distro to have a high degree of reproducibility.
    - deleted 1y ago
      [deleted]
    - pxc 1y ago
      And with even a little bit of imagination, it's easy to think of other possible measures of degrees of reproducibility, e.g.: • % of deployed systems which consist only of reproducibly built packages • % of commonly downloaded disk images (install media, live media, VM images, etc.) consist only of reproducibly built packages • total # of reproducibly built packages available • comparative measures of what NixOS is doing right like: of packages that are reproducibly built in some distros but not others, how many are built reproducibly in NixOS • binary bootstrap size (smaller is better, obviously) It's really not difficult to think of meaningful ways that reproducibility of different distros might be compared, even quantitatively.
- yjftsjthsd-h 1y ago
  > NixOS may not be the absolute leader here (that's probably stagex, or GuixSD if you limit yourself to more practical distros with large package collections), but it is indeed very good. Could you comment on how stagex is? It looks like it might indeed be best in class, but I've hardly heard it mentioned.
  - pabs3 1y ago
    The Bootstrappable Builds folks created a way to go from only an MBR of (commented) machine code (plus a ton of source) all the way up to a Linux distro. The stagex folks built on top of that towards OCI containers. https://stagex.tools/ https://stagex.tools/ https://bootstrappable.org/ https://bootstrappable.org/ https://lwn.net/Articles/983340/ https://lwn.net/Articles/983340/
vlovich123 1y ago
Sure, but in terms of absolute number of packages that are truly reproducible, they outnumber Debian because Debian only targets reproducibility for a smaller fraction of total packages & even there they're not 100%. I haven't been able to find reliable numbers for Fedora on how many packages they have & in particular how many this 99% is targeting. By any conceivable metric Nix really is ahead of the pack. Disclaimer: I have no affiliation with Nix, Fedora, Debian etc. I just recognize that Nix has done a lot of hard work in this space & Fedora + Debian jumping onto this is in no small part thanks to the path shown by Nix.
- Foxboron 1y ago
  They are not. Arch hovers around 87%-90% depending on regressions. https://reproducible.archlinux.org/ https://reproducible.archlinux.org/ Debian reproduces 91%-95% of their packages (architecture dependent) https://reproduce.debian.net/ https://reproduce.debian.net/ > Disclaimer: I have no affiliation with Nix, Fedora, Debian etc. I just recognize that Nix has done a lot of hard work in this space & Fedora + Debian jumping onto this is in no small part thanks to the path shown by Nix This is completely the wrong way around. Debian spearheaded the Reproducible Builds efforts in 2016 with contributions from SUSE, Fedora and Arch. NixOS got onto this as well but has seen less progress until the past 4-5 years. The NixOS efforts owes the Debian project all their thanks.
  - vlovich123 1y ago
    From your own link: > Arch Linux is 87.7% reproducible with 1794 bad 0 unknown and 12762 good packages. That's < 15k packages. Nix by comparison has ~100k total packages they are trying to make reproducible and has about 85% of them reproducible. Same goes for Debian - ~37k packages tracked for reproducible builds. One way to lie with percentages is when the absolute numbers are so disparate. > This is completely the wrong way around. Debian spearheaded the Reproducible Builds efforts in 2016 with contributions from SUSE, Fedora and Arch. NixOS got onto this as well but has seen less progress until the past 4-5 years. The NixOS efforts owes the Debian project all their thanks. Debian organized the broader effort across Linux distros. However the Nix project was designed from the ground up around reproducibility. It also pioneered architectural approaches that other systems have tried to emulate since. I think you're grossly misunderstanding the role Nix played in this effort.

by lima 1y ago

Contrary to popular opinion, Nix builds aren't reproducible: https://luj.fr/blog/is-nixos-truly-reproducible.html https://luj.fr/blog/is-nixos-truly-reproducible.html

pxc 1y ago

That's such a weird characterization of this article, which (in contrast to other writing on this subject) clearly concludes (a) that Nix achieves a very high degree of reproducibility and is continuously improving in this respect, and (b) Nix is moreover reproducible in a way that most other distros (even distros that do well in some measures of bitwise reproducibility) are not (namely, time traveling— being able to reproduce builds in different environments, even months or years later, because the build environment itself is more reproducible). The article you linked is very clear that both qualitatively and quantitatively, NixOS has made achieved high degrees of reproducibility, and even explicitly rejects the possibility of assessing absolute reproducibility. NixOS may not be the absolute leader here (that's probably stagex, or GuixSD if you limit yourself to more practical distros with large package collections), but it is indeed very good. Did you mean to link to a different article?

looofooo0 1y ago
What does high degree mean? Either you achieve bit for bit reproducibility of your builds or not.
- kfajdsl 1y ago
  If 99% of the packages in your repos are bit-for-bit reproducible, you can consider your distro to have a high degree of reproducibility.
  - deleted 1y ago
    [deleted]
  - pxc 1y ago
    And with even a little bit of imagination, it's easy to think of other possible measures of degrees of reproducibility, e.g.: • % of deployed systems which consist only of reproducibly built packages • % of commonly downloaded disk images (install media, live media, VM images, etc.) consist only of reproducibly built packages • total # of reproducibly built packages available • comparative measures of what NixOS is doing right like: of packages that are reproducibly built in some distros but not others, how many are built reproducibly in NixOS • binary bootstrap size (smaller is better, obviously) It's really not difficult to think of meaningful ways that reproducibility of different distros might be compared, even quantitatively.
yjftsjthsd-h 1y ago
> NixOS may not be the absolute leader here (that's probably stagex, or GuixSD if you limit yourself to more practical distros with large package collections), but it is indeed very good. Could you comment on how stagex is? It looks like it might indeed be best in class, but I've hardly heard it mentioned.
- pabs3 1y ago
  The Bootstrappable Builds folks created a way to go from only an MBR of (commented) machine code (plus a ton of source) all the way up to a Linux distro. The stagex folks built on top of that towards OCI containers. https://stagex.tools/ https://stagex.tools/ https://bootstrappable.org/ https://bootstrappable.org/ https://lwn.net/Articles/983340/ https://lwn.net/Articles/983340/

vlovich123 1y ago

Sure, but in terms of absolute number of packages that are truly reproducible, they outnumber Debian because Debian only targets reproducibility for a smaller fraction of total packages & even there they're not 100%. I haven't been able to find reliable numbers for Fedora on how many packages they have & in particular how many this 99% is targeting. By any conceivable metric Nix really is ahead of the pack. Disclaimer: I have no affiliation with Nix, Fedora, Debian etc. I just recognize that Nix has done a lot of hard work in this space & Fedora + Debian jumping onto this is in no small part thanks to the path shown by Nix.

Foxboron 1y ago
They are not. Arch hovers around 87%-90% depending on regressions. https://reproducible.archlinux.org/ https://reproducible.archlinux.org/ Debian reproduces 91%-95% of their packages (architecture dependent) https://reproduce.debian.net/ https://reproduce.debian.net/ > Disclaimer: I have no affiliation with Nix, Fedora, Debian etc. I just recognize that Nix has done a lot of hard work in this space & Fedora + Debian jumping onto this is in no small part thanks to the path shown by Nix This is completely the wrong way around. Debian spearheaded the Reproducible Builds efforts in 2016 with contributions from SUSE, Fedora and Arch. NixOS got onto this as well but has seen less progress until the past 4-5 years. The NixOS efforts owes the Debian project all their thanks.
- vlovich123 1y ago
  From your own link: > Arch Linux is 87.7% reproducible with 1794 bad 0 unknown and 12762 good packages. That's < 15k packages. Nix by comparison has ~100k total packages they are trying to make reproducible and has about 85% of them reproducible. Same goes for Debian - ~37k packages tracked for reproducible builds. One way to lie with percentages is when the absolute numbers are so disparate. > This is completely the wrong way around. Debian spearheaded the Reproducible Builds efforts in 2016 with contributions from SUSE, Fedora and Arch. NixOS got onto this as well but has seen less progress until the past 4-5 years. The NixOS efforts owes the Debian project all their thanks. Debian organized the broader effort across Linux distros. However the Nix project was designed from the ground up around reproducibility. It also pioneered architectural approaches that other systems have tried to emulate since. I think you're grossly misunderstanding the role Nix played in this effort.