Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

discourse.nixos.org

Post reply on HN
Print view View original

131–140 of 179 posts

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#131

Post by iopq »

chpatrick wrote: post #56
dicytea wrote: post #9

Earlier quoted context omitted.

> Guix, Archlinux, Debian do the binary reproducibility better than Nix / NixOS / Nixpkgs. Huh, didn't know that Arch Linux tests reproducibility. It's apparently 85.6% reproducible: https://reproducible.archlinux.org I wonder how much work would be needed for NixOS, considering it has more than 80k packages in the official repository.

I think that's also a bit of an unfair comparison given the number of AUR packages you usually use on Arch. With nixpkgs there isn't a distinction between official and community packages.

Sure there is, the NUR has a few thousand community packages that are not ready for release

The nixpkgs are all official packages, it's just really easy to become a maintainer (you make a pull request adding the package you want to maintain)

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#132

Post by mike_hock »

TacticalCoder wrote: post #122
kaba0 wrote: post #34

Earlier quoted context omitted.

Parallelism. There might be actions that are not order-independent, and the state of the CPU might result in slightly different binaries, but all are correct.

> There might be actions that are not order-independent, and the state of the CPU might result in slightly different binaries, but all are correct. Well no: that's really the thing reproducible packages are showing: there's only one correct binary. And it's the one that's 100% reproducible. I'd even say that that's the whole point: there's only one correct binary. I'll die on the hill that if different binaries are "…

"Correct" does not mean "reproducible" just because you think lowly of irreproducible builds.

A binary consisting of foo.o and bar.o is correct whether foo.o was linked before bar.o or vice versa, provided that both foo.o and bar.o were compiled correctly.

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#133

Post by lrvick »

Now if only they would have maintainers sign packages like almost every other linux distribution has done since the 90s, so we have any idea if the code everyone is building is the same code submitted and reviewed by known individuals.

Until signing is standardized, it is hard to imagine using nix in any production use case that protects anything of value.

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#134

Post by jowea »

londons_explore wrote: post #101
beisner wrote: post #80

Earlier quoted context omitted.

if you have a reproducible build, then the notion of "software was built on date by user " is kind of useless information, no? Because it does not matter - if you can verify that a specific git hash of a codebase results in a particular binary through reproducible builds, a malicious adversary could have built it yesterday and given it to me and i can be almost surely confident (barring hash-collisions...) it's ident…

The usecase is: user wants an easy way to know, from the GUI of some running software, exactly what build/version/git commit/branch/date they're running - perhaps to file a bug report for example. The actual build date doesn't matter if the software is reproducible - but its a proxy for 'how out of date is this software'.

You can still include the git commit id and its date on the build.

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#135

Post by tomcam »

onedognight wrote: post #7

Rebuilding the minimal ISO from source is an impressive milestone on the journey to a system that builds from source reproducibly. Guix had an orthogonal but equally impressive milestone on the same journey recently[0], bootstrapping a full compiler toolchain from a single reproducible 357 byte binary without any other binary compiler blobs. These two features may one day soon be combined to reproducibly build a full…

> bootstrapping a full compiler toolchain from a single reproducible 357 byte binary without any other binary compiler blobs.

wtf that is mind-boggling. Thanks for the link.

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#136

Post by tomcam »

TacticalCoder wrote: post #120
onedognight wrote: post #7

Rebuilding the minimal ISO from source is an impressive milestone on the journey to a system that builds from source reproducibly. Guix had an orthogonal but equally impressive milestone on the same journey recently[0], bootstrapping a full compiler toolchain from a single reproducible 357 byte binary without any other binary compiler blobs. These two features may one day soon be combined to reproducibly build a full…

That is amazing and it is great to see there are people out there fighting the good fight (while others ask: "but where's the benefit!? if there's a backdoor, everybody is still going to get the backdoor!" ). > it gives us a reliable way to verify the binaries we ship are faithful to their sources That's the thing many don't understand: it's not about proving that the result is 100% trustable. It's about proving it's…

Super clarifying, thank you.

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#137

Post by __MatrixMan__ »

lrvick wrote: post #133

Now if only they would have maintainers sign packages like almost every other linux distribution has done since the 90s, so we have any idea if the code everyone is building is the same code submitted and reviewed by known individuals. Until signing is standardized, it is hard to imagine using nix in any production use case that protects anything of value.

My impression of nix package maintainers is that they are providing a useful interface so that software can be composed easily. Most of them are not making any kind of assertion about the contents of the package. Expecting to use their signatures for anything meaningful strikes me as a bit like expecting product support from a delivery driver.

You don't need to trust it wasn't packaged maliciously, nix does reproducible builds so you can just look at the derivation and build it yourself if you don't feel like relying on the binary cache.

As for whether the underlying contents are malicious, that's between you and the developer. If other distributions have have lead you to believe otherwise, then I think they have misled you.

The only exception I can think of is Tails, and they don't exactly have the breadth that Nix does.

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#138

Post by lrvick »

__MatrixMan__ wrote: post #137
lrvick wrote: post #133

Now if only they would have maintainers sign packages like almost every other linux distribution has done since the 90s, so we have any idea if the code everyone is building is the same code submitted and reviewed by known individuals. Until signing is standardized, it is hard to imagine using nix in any production use case that protects anything of value.

My impression of nix package maintainers is that they are providing a useful interface so that software can be composed easily. Most of them are not making any kind of assertion about the contents of the package. Expecting to use their signatures for anything meaningful strikes me as a bit like expecting product support from a delivery driver. You don't need to trust it wasn't packaged maliciously, nix does reproduci…

"Expecting to use their signatures for anything meaningful strikes me as a bit like expecting product support from a delivery driver."

And yet most of the packages from most major linux distributions are signed. If you are going to spend hours maintaining a package, it takes only an extra half a second to tap a yubikey to prevent someone from impersonating you.

Package maintainers from say Arch and Debian go through a vetting process, multiple people sign their keys, and it is a responsibility. Yes, it is volunteer, but there are also volunteer firefighers. Some volunteer jobs are important to keep others safe, and they should be done with care.

If Arch, Debian, Fedora, Ubuntu can all sign packages, then this excuse does not really hold for Nix.

"You don't need to trust it wasn't packaged maliciously, nix does reproducible builds so you can just look at the derivation and build it yourself if you don't feel like relying on the binary cache."

Reproducible builds and package definition signing solve totally different problems. Assume you trust a given developer has been maintaining a package non-maliciously, then you see they made a new update, and so you and other people trust it and build it. You get the same result, so you trust the binaries too. However, you still end up with malware. How? Simple. The developers github account was compromised due to a sim swap on their email account while they were on vacation, and someone pushed a fake commit as that person.

Or maybe a malicious Github employee is bribed to serve manipulated git history only to the reproducible build servers but to no one else, so it goes undetected for years.

Supply chain attacks like this are becoming very common, and there is a lot of motivation to do it to Linux distributions which power systems worth billions of dollars regularly.

It is also so easy to close these risks. Just tap the damn yubikey or nitrokey when it blinks. It is wildly irresponsible not to mandate this, and we should question the motivations of anyone not willing to do something so basic to protect users.

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#139

Post by KingMachiavelli »

lrvick wrote: post #138
__MatrixMan__ wrote: post #137

Earlier quoted context omitted.

My impression of nix package maintainers is that they are providing a useful interface so that software can be composed easily. Most of them are not making any kind of assertion about the contents of the package. Expecting to use their signatures for anything meaningful strikes me as a bit like expecting product support from a delivery driver. You don't need to trust it wasn't packaged maliciously, nix does reproduci…

"Expecting to use their signatures for anything meaningful strikes me as a bit like expecting product support from a delivery driver." And yet most of the packages from most major linux distributions are signed. If you are going to spend hours maintaining a package, it takes only an extra half a second to tap a yubikey to prevent someone from impersonating you. Package maintainers from say Arch and Debian go through…

Nix doesn't have maintainers sign anything because it isn't necessary. The Nix binary cache is built and signed but that's done by builders only the NiXOS foundation controls.

Individual maintainers just commit Nix code to build the packages... Do you mean you want their Git commits to be signed?

Edit: I guess that is what you mean. That is distinct from package (binary) signing. How do you know that a distro's repos built using the signed commits? NixOS is actually better suited to prove that an particular commit produced the package.

Re: NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

#140

Post by chpatrick »

iopq wrote: post #131
chpatrick wrote: post #56

Earlier quoted context omitted.

I think that's also a bit of an unfair comparison given the number of AUR packages you usually use on Arch. With nixpkgs there isn't a distinction between official and community packages.

Sure there is, the NUR has a few thousand community packages that are not ready for release The nixpkgs are all official packages, it's just really easy to become a maintainer (you make a pull request adding the package you want to maintain)

I'm just saying that X% of arch official packages being reproducible isn't a complete statistic when many day to day things are in AUR, most of which are in nixpkgs not NUR.
Post reply on HN