Hacker News Reader

Comment by yjftsjthsd-h | Hacker News Reader

Sure, there's no technical blocker, but the article seems to be implying that they shouldn't:

> One of the nice things about Tow-Boot is that it leverages the Nix build system to generate a nice reproducable build of the platform firmware. This should take away some of the doubts of having a prebuild platform firmware instead of every distribution figuring out how to do this from source. Also distributions not doing this from source would mean there's less chance of inconsistencies slipping in.

View on HN

What’s the difference between a reproducible binary and one they’ve built themselves? Can’t they just build it from source and check that the digests match?

I mean heck, since it's a Nix Package, couldn't they just build it with Nix as the build system? And if for any reason that is the issue (installing Nix on a foreign distros can be pretty invasive, containerized?), the recipe for how to build it is right there.

> installing Nix on a foreign distros can be pretty invasive

Is this some kind of joke?

Installing nix on a non-nixOS computer doesn't even require root. You can even bootstrap the entirety of nixpkgs that way. That's one of the most awesome things about nix and nixpkgs.

It most certainly does require root to install nix, as it needs the /nix directory on Linux to work

That's like saying that logging in as an ordinary user "requires root" because otherwise /home/ordinary_user wouldn't exist. This is silly.

In any event, the nix store doesn't need to be in "/nix/store" anymore: https://nixos.wiki/wiki/Nix_Installation_Guide#nix_2.0.27s_n...

If you're willing to recompile the nix interpreter and sacrifice cached binaries you don't even need namespaces or ptrace. Just

  ./configure --with-store-dir=xyz

when you build the nix interpreter.

Reply on news.ycombinator.com