NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

Post by Smaug123 » Sun, Oct 29, 2023, 5:02 PM UTC

ndriscoll wrote: post #85

beisner wrote: post #80

Earlier quoted context omitted.

if you have a reproducible build, then the notion of "software was built on date by user " is kind of useless information, no? Because it does not matter - if you can verify that a specific git hash of a codebase results in a particular binary through reproducible builds, a malicious adversary could have built it yesterday and given it to me and i can be almost surely confident (barring hash-collisions...) it's ident…

Your source would also have to have a reference to which exact version of which compiler to use, which versions of which external headers to use, etc. and now you're inventing Nix. Conceivably there could be a standard for a sidecar file to specify how something was built (e.g. nixpkgs commit hash, or all of the parameters that went into the build). Or content address the inputs, i.e. invent Nix again. So we could so…

Post by edgyquant » Sun, Oct 29, 2023, 5:06 PM UTC

traxys wrote: post #89

dataflow wrote: post #84

Earlier quoted context omitted.

Would be nice if you could explain how/why this happens, given that normally, pointers aren't persisted.

I think they meant if you cast a pointer to an integer, do some math on that and then store that. Then you will a stored result that will likely differ from run to run

Post by chpatrick » Sun, Oct 29, 2023, 5:14 PM UTC

goodpoint wrote: post #76

chpatrick wrote: post #23

Earlier quoted context omitted.

> Sorry for being dense, but I thought one of the main reason for nixos's existence is reproducibilty. I thought they have these kinds of things solved already. Nixos has the advantage that everything is built in its own sandbox with only its explicitly declared (and hashed) dependencies available, unlike in mainstream distros where it's the full system environment, so in many cases you already get the same binary ev…

> unlike in mainstream distros Debian has been building in a clean sandbox with only required, tracked dependencies since decades. It's also building the large majority of packages reproducibly including the binary and whole installation packages (not just the sources like nixos)

Post by autumn-antlers » Sun, Oct 29, 2023, 5:35 PM UTC

ralferoo wrote: post #69

jowea wrote: post #30

Earlier quoted context omitted.

This[0] is basically the hand-documentation of those bytes then. Handwritten ELF header and assembly code. [0] https://github.com/oriansj/bootstrap-seeds/blob/master/POSIX...

Just had a read of this to see what it did... And I must admit, I don't understand what purpose this is supposed to serve. All it seems to do is convert hex into binary and dump it to a file. Not sure how that's any more useful than just copying the binary for next stage directly, after all this binary had to get on the system somehow.

Post by Reventlov » Sun, Oct 29, 2023, 5:43 PM UTC

clhodapp wrote: post #26

Reventlov wrote: post #4

For those wondering : it should be remembered that the reproducibility of Nix / NixOS / Nixpkgs is only a reproducibility of the sources: if the sources change, one is warned, but it is not a question of the reproducibility of the binaries (which can change at each build). This binary reproducibility of Nix / NixOS / Nixpkgs is indeed not really tested, at least not systematically. Guix, Archlinux, Debian do the bina…

That is not true at all, with respect to the aims or the reality of nixpkgs. The original post here is talking about reproducing the (binary) minimal iso, which contains a bunch of binary packages.