Live data from Hacker News

Ditch your version manager

juliu.is

91–100 of 155 posts

Re: Ditch your version manager

#91

Looks interesting enough... But how does one solve the issue of security level updates for some dependency language? Or when a particular version of some application reaches EOL and is no longer maintained, or theres some functionality in a newer version of Nodejs|Ruby|etc thats needed? From what I understand this would require an update to the Nix version that supports it... but that also potentially means bumping o…

> But how does one solve the issue of security level updates for some dependency language? Or when a particular version of some application reaches EOL and is no longer maintained, or theres some functionality in a newer version of Nodejs|Ruby|etc thats needed?

Nix supports building packages from multiple package sources. e.g. maybe you want an old version of some package which is only available in an older release of nixpkgs. It would be possible to use the older nixpkgs release to install that old package, and a newer nixpkgs release for the others. -- You even don't have to use the main nixpkgs repository.

> But I suppose this would amount to the user arranging the structure of their filesystem correctly so its one "system" per dir/folder.

Nix handles its filesystem arrangement for all of the "multiple different versions of some package" already. That's part of Nix's value proposition.

This also allows being able have packages available in your shell without having to 'pollute' the rest of the system is a neat dynamic, particularly with direnv.

> Theres clearly more to Nix than just setting up language environments, which I'm guessing is where its usefuleness really kicks in.

Depends how often you (want to) jump into fresh environments, but e.g. Nix allows being able to have a consistent set of programs installed quite easily.

Re: Ditch your version manager

#92
post #87

First, you want a "dependency manager". That's not what Nix is, clearly. Nix is a package manager. Second, to use this package manager, you first need to install direnv . How do you install it? with brew , a different package manager. Third, you have to learn a new functional programming language. Right. Because normally to put together a toolbox, I often learn to speak a few phrases in Swahili first. Fourth, finally…

> First, you want a "dependency manager". That's not what Nix is, clearly. Nix is a package manager. This is not true. The defining point about Nix is that it allows to define all dependencies explicitly. Every derivation in it is built inside of a sandbox with no access to network and restricted filesystem. This ensures that nothing is accidentally missed. Package management is just one of features. > Second, to use…

> Because the starting state and all dependencies are known it can always create the same result, that's the biggest selling point of Nix to me.

And you can do that with the package manager of any Linux distro today. It sounds like Nix's biggest selling point is it does something we can already do.

Re: Ditch your version manager

#93
post #80

First, you want a "dependency manager". That's not what Nix is, clearly. Nix is a package manager. Second, to use this package manager, you first need to install direnv . How do you install it? with brew , a different package manager. Third, you have to learn a new functional programming language. Right. Because normally to put together a toolbox, I often learn to speak a few phrases in Swahili first. Fourth, finally…

First, dependency manager vs package manager. Potayto potatoh. Second. The reason I recommend direnv is because of ergonomics, so you don't have to remember to reload your shell. Most current version managers either do it themselves through shell hooks or ask you to install direnv. Point taken on using brew: I've changed it to use nix-env. Third. Yep. Sort of like having to learn English before you can learn programm…

> No other package manager can freeze the complete dependency set you are using

I don't know if you realise that your post makes a poor case for that, and for imagined reproducibility of nix builds?

1. Direct quote from your post: "if you tried to follow this article step by step, you’ll have noticed that the versions of ruby and node you installed are probably slightly different from the ones above".

The "solution" for that is to dig through some commit hashes, and use those.

Commit hashes are not versions.

2. Your example points to a completely random version of a package

The previous issue already points to a random version, apparently, but this is further compounded by the fact that "ruby_2_6" and "nodejs-10_x" point to a random version that is available at the time.

To truly make the claim that nix allows reproducible builds, it needs to provide:

- a way to specify versions that don't depend on the commit hash of a "nixpck channel" whatever that is

- a way to actually properly pin package versions. Something that all package/dependency managers allow you to. If I want to pin ruby to exactly 2.6.7, for an actual reproducible build, what is nix' solution for that?

Re: Ditch your version manager

#94
post #78

Earlier quoted context omitted.

$ VER=$(dpkg -s alsa-oss | grep -m1 '^Version: ' | sed -e 's/^Version: //g') $ cat > Dockerfile That's a complicated example. All you need to do is get a working system, specify the base image tag, run dpkg -l and write down all the versions, then pass them to apt-get install . It's super easy. It's much more complicated to do something like download a static Go app from a specific URL, import a GPG key, validate the…

Ah, though note there, you want to specify the base image by hash instead of by tag -- I've been bitten by that before...

The use of a non-static tag is intentional to pick up security and bug fixes. It's like using a "stable" branch, where you expect to get any emergency fixes to the stable branch. Only in this case it's a release-specific stable branch. If you ran a system with some compliance mandate that not even security fixes could be automatically applied, then you'd pin to the hash.

Re: Ditch your version manager

#95

Looks interesting enough... But how does one solve the issue of security level updates for some dependency language? Or when a particular version of some application reaches EOL and is no longer maintained, or theres some functionality in a newer version of Nodejs|Ruby|etc thats needed? From what I understand this would require an update to the Nix version that supports it... but that also potentially means bumping o…

There are multiple ways of doing it. The obvious one (updating nixpkgs) you already mentioned.

Second way is to override[1], in documentation they are showing how to change compilation parameters, but you can also use this to change version of dependencies or source tarball for the package. As you use Nix you will eventually need to do it as sometimes package was not updated, or perhaps you need to use older version, or enable compilation option.

Third way is to use overlay[2]. In previous way an existing package was modified. Overlay allows to completely replace or add a new one.

For example there is a tool called poetry2nix[3], which on the fly translates python poetry lock file to Nix so nix can build them. Nixpkgs includes it and generally is frequently updated, but maybe there was a fix yesterday that hadn't made it there yet and it fixes an important bug. You can fetch that repo independently and attach it to nixpkgs (or you can use it directly).

Nix also has upcoming feature flakes which to my understanding takes this to a new level. So you can easily compose multiple repos like this in your application.

> Theres clearly more to Nix than just setting up language environments, which I'm guessing is where its usefuleness really kicks in. But purely for lang env set up, I'm not sure I see a point over other tooling...

I use it this way and the killer feature for myself is that for a project all I need to have installed is Nix and I can have exact environment the dev used.

It's not mentioned often, but I think a demo of it would be the repo for Nix program[4]. Typically when you want to compile some open source program, after you check out the repo, a hunt starts for the building tools and libraries needed. With nix you just issue build command or enter build shell[5] and things just work with no errors (or at least I did not get them when trying it a while ago. Everything worked on first try).

[1] https://nixos.org/manual/nixpkgs/stable/#chap-overrides

[2] https://nixos.org/manual/nixpkgs/stable/#chap-overlays

[3] https://github.com/nix-community/poetry2nix

[4] https://github.com/nixos/nix

[5] https://hydra.nixos.org/build/153568733/download/1/manual/co...

Re: Ditch your version manager

#97
The problem I have with Nix (and Guix) is that you're shit out of luck if you need it to work together with some network based package manager or existing project that someone didn't add to it yet.

It gets really complicated really fast, and things that "just work" with other packages managers and projects, because they are opinionated and linux-y, most of the time don't work well with Nix or have to be shoehorned into it.

It always feels like you're fighting against everything to get things into Nix that just weren't meant to be.

Re: Ditch your version manager

#98

Earlier quoted context omitted.

It's not about what is possible, it is about ergonomics. We could have used email for conversations online, yet we use Slack. Other tool require lots of thought and carefull execution for what Nix gives you for free.

> Other tool require lots of thought and carefull execution for what Nix gives you for free. How do I pin ruby version to 2.6.3 in Nix? This is given to me for free in other tools. As are reproducible builds because all modern package/dependency managers lock versions.

Last week I had a problem with our CI/CD pipeline because an old package that's a sub dependency wouldn't install anymore. [1]

See that `rev` line in the sources.json? The whole build system is pinned by on git commit. If it builds today, it will build tomorrow. No matter what. That alone resolves a huge category of potential problems.

There's much, much more to it. Nix stores each package in its own path. [2] This makes it possible to install multiple versions of one application or library next to each other. With the power of direnv only the versions one needs are included.

[1] https://github.com/tikitu/jsmin/issues/33

[2] > ls /nix/store/ |head 000dm655691b5zis34klvhlil3hrv7j5-fftw-3.3.9.tar.gz.drv 005m4pqd29k976if66fpbggjsdxhchdg-python3.8-astroid-2.5.1.drv 007hqps3i495yjk223vhckin27vggk81-recode-3.7.8.tar.gz.drv 009815w1n26nl10rgffgahk7aka80p1m-nodejs-14.17.0 00a9nyyhwxisv4vc4rvwzp71nfip53x9-user-environment.drv 00m5h0pfzw2182qmyganlkaa9j4l2hps-vector-th-unbox-0.2.1.9.drv 010v6j5jjk2wpniznas31hbwvz1p1f5d-zapfding.r31835.tar.xz.drv 013sdi43bca33mnc3gn0v5r8lifrgcdj-hwdata-0.347.drv 01c3690lhmk0za0hnnh23n6mfgmiijpf-libdv-1.0.0.drv 01kc15hni6gff4z1p3y14v9f1395x2pf-python3.8-tap.py-3.0.drv

Re: Ditch your version manager

#99

Earlier quoted context omitted.

> Other tool require lots of thought and carefull execution for what Nix gives you for free. How do I pin ruby version to 2.6.3 in Nix? This is given to me for free in other tools. As are reproducible builds because all modern package/dependency managers lock versions.

Last week I had a problem with our CI/CD pipeline because an old package that's a sub dependency wouldn't install anymore. [1] See that `rev` line in the sources.json? The whole build system is pinned by on git commit. If it builds today, it will build tomorrow. No matter what. That alone resolves a huge category of potential problems. There's much, much more to it. Nix stores each package in its own path. [2] This m…

> a problem with our CI/CD pipeline because an old package that's a sub dependency wouldn't install anymore

> The whole build system is pinned by on git commit. If it builds today, it will build tomorrow. No matter what.

If that commit is still available. This still doesn't answer the question of how I easily pin a version. The package versions in the post point to what amounts to a random package version.

And that's on top the fact that "if you tried to follow this article step by step, you’ll have noticed that the versions of ruby and node you installed are probably slightly different from the ones above"

> Nix stores each package in its own path.

This is a part that I like.

Re: Ditch your version manager

#100

First, you want a "dependency manager". That's not what Nix is, clearly. Nix is a package manager. Second, to use this package manager, you first need to install direnv . How do you install it? with brew , a different package manager. Third, you have to learn a new functional programming language. Right. Because normally to put together a toolbox, I often learn to speak a few phrases in Swahili first. Fourth, finally…

> Nix is basically just the new Gentoo: a distro for hobbyists who tell themselves they're advanced while all the professionals use something else.

As a Gentoo user and someone who has tried and grokked Nix/Guix, this is not true at all. Gentoo is essentially a system for creating distributions, a meta-distro if you like. It just so happens to be something that appeals to someone like me to run at home because, well, why not? I know exactly what I need/want on my computer and this lets me build my own custom distro tailored for me.

Nix/Guix is something completely different. It addresses real problems that arise in a variety of places in an elegant way. Containers are another solution to some of these problems, but come with their own tradeoffs.

Your blanket statement about "professionals" makes no sense. I don't use Gentoo at work because it's not my job to maintain custom Linux systems or create distros. But guess what? Not everyone has the same job. You don't speak for all "professionals". I can distinctly remember around 2007 people saying this exact thing about git. I was told geeks were only learning it to make themselves feel clever and that SVN was fine. Well look how that turned out. I'm glad I ignored those people.

Post reply on HN