Hacker News Reader

Comment by nextos | Hacker News Reader

Nix/Guix are quite cool to tackle this.

They are progressing quite quickly towards reproducible builds, so you can avoid compromised servers sending malicious binaries.

Also, since package definitions are quite declarative, I guess it's easier to perform static verification to spot malicious code getting introduced there.

There's e.g. Vulnix that scans for CVEs [1].

[1] https://github.com/flyingcircusio/vulnix

View on HN

I believe they aren’t just progressing towards reproducible builds, but that the whole system is already predicated on them. In Nix, you have to make special exceptions for packages that aren’t rebuildable from source.

Rebuildable is different than reproducible. The Nix system is predicated on rebuilding. Ideally the binaries would be all also reproducible however it turns out making compilation completely deterministic is actually pretty hard. When we reach that point and me and you can both independently produce identical binaries and hash them from exactly the same source code that is beyond fantastic for security and auditing.

r13y.com tracks the progress for NixOS reproducibility (well, for the tiny subset of nixpkgs that forms the minimal ISO image at least).

NixOS (and NixPkgs) is great, but there are still plenty of binary only packages from difficult to build projects like PhantomJS in the ecosystem. It takes a serious commitment to build complex projects in Nix and maintain them.

(edit) An example of binary packages in Nixpkgs: https://github.com/NixOS/nixpkgs/blob/master/pkgs/developmen...

Should you really be installing programs that are impossible to build? Also phantomjs is discontinued.

That's a great question, but it does not invalidate the point that there is nothing about Nix that states that binary packages cannot and do not happen.

Try for example FHS environments. That should make it possible to install software in a conventional way.

You can also build regular packages, no matter how complicated they are, by spanning an FHS environment. That's sort of a sandbox that simulates a regular Unix environment with whatever dependencies you need in the usual places (/bin, /usr, ...).

Of course, you loose some Nix advantages. But it's a great way to get a regular Unix environment for one-off things or desperate cases.

Reply on news.ycombinator.com