|
| 1 | +<!DOCTYPE html> |
| 2 | + |
| 3 | +<html lang="en"> |
| 4 | +<head> |
| 5 | +<title>Nix Reproducible Builds</title> |
| 6 | +<link rel="stylesheet" href="styles/index.css"> |
| 7 | +<style> |
| 8 | +body { |
| 9 | + padding: 3em; |
| 10 | +} |
| 11 | +</style> |
| 12 | +</head> |
| 13 | +<body> |
| 14 | +<h1>Nix Reproducible Builds</h1> |
| 15 | +<p> |
| 16 | +Because a Nix derivation has deterministic references to all |
| 17 | +of its dependencies, and the build is being ran in a sandbox, |
| 18 | +Nix is an excellent starting point for achieving bit-by-bit |
| 19 | +<a href="https://reproducible-builds.org/">Reproducible Builds</a>. |
| 20 | +</p> |
| 21 | + |
| 22 | +<p> |
| 23 | +However, this is not sufficient in itself: builds may still include |
| 24 | +timestamps or have other nondeterminisms. Such problems are tracked |
| 25 | +in the <a href="https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%226.topic%3A+reproducible+builds%22">'reproducible builds' issue tag</a>. |
| 26 | +You can report a new issue using the <a href="https://github.com/NixOS/nixpkgs/issues/new?assignees=&labels=0.kind%3A+enhancement%2C6.topic%3A+reproducible+builds&template=unreproducible_package.md&title=">issue template</a>. |
| 27 | +</p> |
| 28 | + |
| 29 | +<p> |
| 30 | +To check whether you can reproduce a package on your machine, |
| 31 | +you can use <code>nix-build '<nixpkgs>' -A hello --check --keep-failed</code>. |
| 32 | +On failures, you can use <a href="https://diffoscope.org">diffoscope</a> |
| 33 | +to analyze the differences in the outputs of the two builds. To view |
| 34 | +the build log of the build that produced the artifact in the binary cache you can use <code>nix-store --read-log $(nix-instantiate '<nixpkgs>' -A hello)</code>. |
| 35 | +</p> |
| 36 | + |
| 37 | +<p> |
| 38 | +As a general health check, we are producing reports on the |
| 39 | +reproducibility of the packages that make up the build closure |
| 40 | +of our minimal installation ISO, and the Gnome one. Note that |
| 41 | +this not only includes all packages that make it into the ISO, |
| 42 | +but also all build-time dependencies of those packages: |
| 43 | +</p> |
| 44 | +<ul> |
| 45 | +<li><a href="nixos-iso-minimal-r13y">Minimal ISO</a> |
| 46 | +<li><a href="nixos-iso-gnome-r13y">Gnome ISO</a> |
| 47 | +</ul> |
| 48 | +</body> |
| 49 | +</html> |
0 commit comments