News for hackers. Stuff that matters.

A comment on NixOS Reproducible Builds: minimal ISO successfully independently rebuilt. Parent comment

Re:NixOS Reproducible Builds: minimal ISO successfully indep... by dataflow on Sunday October 29, 2023 @12:14PM (#38059949)
Doesn't caching completely defeat the point of bootstrapping? How do you know the cached artifact is correct?
[ Parent | on HN ]
Re:NixOS Reproducible Builds: minimal ISO successfully indep... by mbakke on Sunday October 29, 2023 @12:28PM (#38060120)
Guix has tooling to verify binaries:

https://guix.gnu.org/en/manual/en/html_node/Invoking-guix-ch...

"guix build --no-grafts --no-substitutes --check foo" will rebuild package foo and fail if the result is not bit-identical. "guix challenge" will compare your local binaries against multiple cache servers.

I build everything locally and compare my results with the official substitute servers from time to time.

[ Parent | on HN ]
Re:NixOS Reproducible Builds: minimal ISO successfully indep... by __MatrixMan__ on Sunday October 29, 2023 @12:22PM (#38060040)
1. hash it

2. rebuild it without the cache

3. hash that

4. compare

Or, trust somebody who has. Inconvenient, but is there any other way to establish trust in the correspondence between code and a binary?

[ Parent | on HN ]
Re:NixOS Reproducible Builds: minimal ISO successfully indep... by pharmakom on Sunday October 29, 2023 @04:06PM (#38062189)
You have a hash that n trusted parties agree on. This is enabled by reproducible builds.
[ Parent | on HN ]