TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

NixOS Reproducible Builds: minimal ISO successfully independently rebuilt

548 点作者 CathalMullan超过 1 年前

11 条评论

onedognight超过 1 年前
Rebuilding the minimal ISO from source is an impressive milestone on the journey to a system that builds from source reproducibly. Guix had an orthogonal but equally impressive milestone on the same journey recently[0], bootstrapping a full compiler toolchain from a single reproducible 357 byte binary without any other binary compiler blobs. These two features may one day soon be combined to reproducibly build a full distribution from source.<p>[0] <a href="https:&#x2F;&#x2F;guix.gnu.org&#x2F;en&#x2F;blog&#x2F;2023&#x2F;the-full-source-bootstrap-building-from-source-all-the-way-down&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;guix.gnu.org&#x2F;en&#x2F;blog&#x2F;2023&#x2F;the-full-source-bootstrap-...</a>
评论 #38062594 未加载
评论 #38059865 未加载
评论 #38058054 未加载
评论 #38058402 未加载
评论 #38063839 未加载
评论 #38060771 未加载
评论 #38069532 未加载
评论 #38058921 未加载
ahmedfromtunis超过 1 年前
Stupid question as I never worked on something like this before: why isn&#x27;t reproducibility the default behavior?<p>I mean if 2 copies of a piece of software were compiled from the same source, what stops them from being identical each and every time?<p>I know there are so many moving parts, but I still can&#x27;t understand how discrepancies can manifest themselves.
评论 #38058947 未加载
评论 #38058760 未加载
评论 #38058754 未加载
评论 #38059284 未加载
评论 #38058951 未加载
评论 #38061047 未加载
评论 #38058729 未加载
评论 #38058963 未加载
mihalycsaba超过 1 年前
Sorry for being dense, but I thought one of the main reason for nixos&#x27;s existence is reproducibilty. I thought they have these kinds of things solved already.<p>I have only ~2 hours experience with Nixos, wanted to try hyprland, I thought it would be easier on Nixos since hyprland needs a bit of setup and maybe it&#x27;s easier to use someone else&#x27;s config on nixos, than on some other distro. Finding a config was hard too, found like 3 on some random github gists, thought there would be more... and none of them worked, at that point I gave up.
评论 #38058526 未加载
评论 #38057939 未加载
评论 #38057936 未加载
评论 #38058700 未加载
评论 #38058103 未加载
评论 #38059611 未加载
Reventlov超过 1 年前
For those wondering : it should be remembered that the reproducibility of Nix &#x2F; NixOS &#x2F; Nixpkgs is only a reproducibility of the sources: if the sources change, one is warned, but it is not a question of the reproducibility of the binaries (which can change at each build). This binary reproducibility of Nix &#x2F; NixOS &#x2F; Nixpkgs is indeed not really tested, at least not systematically.<p>Guix, Archlinux, Debian do the binary reproducibility better than Nix &#x2F; NixOS &#x2F; Nixpkgs.<p>Sources :<p>- <a href="https:&#x2F;&#x2F;r13y.com&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;r13y.com&#x2F;</a> ( Nix* )<p>- <a href="https:&#x2F;&#x2F;tests.reproducible-builds.org&#x2F;debian&#x2F;reproducible.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;tests.reproducible-builds.org&#x2F;debian&#x2F;reproducible.ht...</a> ( Debian )<p>- <a href="https:&#x2F;&#x2F;tests.reproducible-builds.org&#x2F;archlinux&#x2F;archlinux.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;tests.reproducible-builds.org&#x2F;archlinux&#x2F;archlinux.ht...</a> ( Archlinux )<p>- <a href="https:&#x2F;&#x2F;data.guix.gnu.org&#x2F;repository&#x2F;1&#x2F;branch&#x2F;master&#x2F;latest-processed-revision&#x2F;package-reproducibility" rel="nofollow noreferrer">https:&#x2F;&#x2F;data.guix.gnu.org&#x2F;repository&#x2F;1&#x2F;branch&#x2F;master&#x2F;latest-...</a> (Guix, might be a bit slow to load, here is some cached copy <a href="https:&#x2F;&#x2F;archive.is&#x2F;lTuPk" rel="nofollow noreferrer">https:&#x2F;&#x2F;archive.is&#x2F;lTuPk</a> )
评论 #38058856 未加载
评论 #38059059 未加载
评论 #38058452 未加载
评论 #38057975 未加载
评论 #38058574 未加载
评论 #38057967 未加载
评论 #38063371 未加载
somat超过 1 年前
I find it funny(ironic) that the OpenBSD project is trying hard to go the other way, every single install has unique and randomized address offsets.<p>While I understand that these two goals, reproducible builds and unique installs, are orthogonal to each other, both can be had at the same time, the duality of the situation still makes me laugh.
评论 #38058459 未加载
评论 #38059522 未加载
lrvick超过 1 年前
Now if only they would have maintainers sign packages like almost every other linux distribution has done since the 90s, so we have any idea if the code everyone is building is the same code submitted and reviewed by known individuals.<p>Until signing is standardized, it is hard to imagine using nix in any production use case that protects anything of value.
评论 #38063909 未加载
评论 #38064755 未加载
mbakke超过 1 年前
Very impressive milestone, congrats to those who made this possible!<p>&gt; [...] actually rebuilding the ISO still introduced differences. This was due to some remaining problems in the hydra cache and the way the ISO was created.<p>Can anyone shed some light on the fix for &quot;how the ISO was created&quot;? I attempted making a reproducible ISO a while back but could not make the file system create extents in a deterministic fashion.
评论 #38060196 未加载
mgaunard超过 1 年前
Don&#x27;t you have to fake the system time to do this? The time often ends up inside the binaries one way or another.
评论 #38059337 未加载
评论 #38059388 未加载
评论 #38069083 未加载
Uptrenda超过 1 年前
Wouldn&#x27;t this help solve the problem Ken Thompson wrote about in &#x27;reflections on trusting trust?&#x27; If you can fully bootstrap a system from source code then it&#x27;s harder to have things like back-doored compilers.
评论 #38065568 未加载
KennyFromIT超过 1 年前
I&#x27;ve lived in the Red Hat ecosystem for work recently. How does this compare to something like... Fedora Silverblue? Ansible? Fedora Silverblue + Ansible?
评论 #38058242 未加载
评论 #38058550 未加载
评论 #38067204 未加载
Crontab超过 1 年前
I love that there are people out there who cares about things like this.