Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

discourse.nixos.org

Post reply on HN
Print view View original

21–30 of 179 posts

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#21

Post by oever »

somat wrote: post #15

I find it funny(ironic) that the OpenBSD project is trying hard to go the other way, every single install has unique and randomized address offsets. While I understand that these two goals, reproducible builds and unique installs, are orthogonal to each other, both can be had at the same time, the duality of the situation still makes me laugh.

If the address offsets can be randomized with a provided seed, then demonstrating reproducibility is still possible.

Alternatively, randomizing the offsets when starting the program is another way to keep reproducibility and even increase security; the offsets would change at every run.

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#22

Post by ahoka »

15155 wrote: post #18
onedognight wrote: post #7

Rebuilding the minimal ISO from source is an impressive milestone on the journey to a system that builds from source reproducibly. Guix had an orthogonal but equally impressive milestone on the same journey recently[0], bootstrapping a full compiler toolchain from a single reproducible 357 byte binary without any other binary compiler blobs. These two features may one day soon be combined to reproducibly build a full…

At 357 bytes, do you need a reproducible binary at all? I'd think one could hand-document all 357 bytes of machine code and have them be intelligible.

That’s just the first stage. Simple enough to be audited manually.

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#23

Post by chpatrick »

mihalycsaba wrote: post #3

Sorry for being dense, but I thought one of the main reason for nixos's existence is reproducibilty. I thought they have these kinds of things solved already. I have only ~2 hours experience with Nixos, wanted to try hyprland, I thought it would be easier on Nixos since hyprland needs a bit of setup and maybe it's easier to use someone else's config on nixos, than on some other distro. Finding a config was hard too,…

> Sorry for being dense, but I thought one of the main reason for nixos's existence is reproducibilty. I thought they have these kinds of things solved already.

Nixos has the advantage that everything is built in its own sandbox with only its explicitly declared (and hashed) dependencies available, unlike in mainstream distros where it's the full system environment, so in many cases you already get the same binary every time. But this doesn't immediately lead to reproducibility because the build process might be nondeterministic for various packages.

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#24

Post by candiddevmike »

KennyFromIT wrote: post #16

I've lived in the Red Hat ecosystem for work recently. How does this compare to something like... Fedora Silverblue? Ansible? Fedora Silverblue + Ansible?

Nix is a declarative OS, where you describe what the OS should look like, instead of Ansible where you give the OS steps to follow. Silverblue and Nix are orthogonal aside from being Linux distributions--Silverblue is attempting to change how software is delivered using only containers on an immutable host.

If you're interested in an Ansible alternative that uses Jsonnet and state tracking to somewhat mimic Nix, check out Etcha: https://etcha.dev

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#25

Post by jowea »

quietbritishjim wrote: post #6
mihalycsaba wrote: post #3

Sorry for being dense, but I thought one of the main reason for nixos's existence is reproducibilty. I thought they have these kinds of things solved already. I have only ~2 hours experience with Nixos, wanted to try hyprland, I thought it would be easier on Nixos since hyprland needs a bit of setup and maybe it's easier to use someone else's config on nixos, than on some other distro. Finding a config was hard too,…

There are two senses of reproducible. The sense you're thinking of is that you can easily rebuild a binary package and it will use the same dependency versions, build options, etc. There should be no chance of a compiler error that didn't happen the first time (the old "but it worked on my laptop" syndrome). The sense used here is that every build output is byte-for-byte binary identical . It doesn't depend on the ma…

> The sense you're thinking of is that you can easily rebuild a binary package and it will use the same dependency versions, build options, etc. There should be no chance of a compiler error that didn't happen the first time (the old "but it worked on my laptop" syndrome).

And that's just for Nixpkgs, the packages themselves that also work outside NixOS. NixOS has reproducibility of the entire system complete with configuration.

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#26

Post by clhodapp »

Reventlov wrote: post #4

For those wondering : it should be remembered that the reproducibility of Nix / NixOS / Nixpkgs is only a reproducibility of the sources: if the sources change, one is warned, but it is not a question of the reproducibility of the binaries (which can change at each build). This binary reproducibility of Nix / NixOS / Nixpkgs is indeed not really tested, at least not systematically. Guix, Archlinux, Debian do the bina…

That is not true at all, with respect to the aims or the reality of nixpkgs. The original post here is talking about reproducing the (binary) minimal iso, which contains a bunch of binary packages.

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#27

Post by mbakke »

Very impressive milestone, congrats to those who made this possible!

> [...] actually rebuilding the ISO still introduced differences. This was due to some remaining problems in the hydra cache and the way the ISO was created.

Can anyone shed some light on the fix for "how the ISO was created"? I attempted making a reproducible ISO a while back but could not make the file system create extents in a deterministic fashion.

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#28

Post by benreesman »

chpatrick wrote: post #23
mihalycsaba wrote: post #3

Sorry for being dense, but I thought one of the main reason for nixos's existence is reproducibilty. I thought they have these kinds of things solved already. I have only ~2 hours experience with Nixos, wanted to try hyprland, I thought it would be easier on Nixos since hyprland needs a bit of setup and maybe it's easier to use someone else's config on nixos, than on some other distro. Finding a config was hard too,…

> Sorry for being dense, but I thought one of the main reason for nixos's existence is reproducibilty. I thought they have these kinds of things solved already. Nixos has the advantage that everything is built in its own sandbox with only its explicitly declared (and hashed) dependencies available, unlike in mainstream distros where it's the full system environment, so in many cases you already get the same binary ev…

This is a really good comment, I have no idea why it’s going grey.

Upvote from me FWIW.

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#29

Post by [deleted] »

candiddevmike wrote: post #24
KennyFromIT wrote: post #16

I've lived in the Red Hat ecosystem for work recently. How does this compare to something like... Fedora Silverblue? Ansible? Fedora Silverblue + Ansible?

Nix is a declarative OS, where you describe what the OS should look like, instead of Ansible where you give the OS steps to follow. Silverblue and Nix are orthogonal aside from being Linux distributions--Silverblue is attempting to change how software is delivered using only containers on an immutable host. If you're interested in an Ansible alternative that uses Jsonnet and state tracking to somewhat mimic Nix, chec…

[deleted]

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#30

Post by jowea »

15155 wrote: post #18
onedognight wrote: post #7

Rebuilding the minimal ISO from source is an impressive milestone on the journey to a system that builds from source reproducibly. Guix had an orthogonal but equally impressive milestone on the same journey recently[0], bootstrapping a full compiler toolchain from a single reproducible 357 byte binary without any other binary compiler blobs. These two features may one day soon be combined to reproducibly build a full…

At 357 bytes, do you need a reproducible binary at all? I'd think one could hand-document all 357 bytes of machine code and have them be intelligible.

This[0] is basically the hand-documentation of those bytes then. Handwritten ELF header and assembly code.

[0] https://github.com/oriansj/bootstrap-seeds/blob/master/POSIX...

Post reply on HN