I don't know that Nix [0] is up to building crypto-safe deterministic builds, but it certainly works to be more deterministic than most other build methodologie

I don't know that Nix [0] is up to building crypto-safe deterministic builds, but it certainly works to be more deterministic than most other build methodologies. Nix works very hard to ensure that during build the only resources visible to the builder are those specified in the build script. Then that build information is hashed and carried along with the result of the Nix build as its fingerprint. The fingerprint is passed on to anything which depends on the build results. The end result is that the final fingerprint of a build artifact is extremely sensitive to absolutely every choice made during the build and it's very hard for the artifact to depend on anything that hasn't been deliberately chosen in the build scripts. Together these facts help to ensure a kind of global, repeatable build determinism pretty much unheard of outside of Nix. [0] The project Guix is forking