!LemuOOvbWqRXodtSsw:nixos.org

NixOS Reproducible Builds

484 Members
Report: https://reproducible.nixos.org Project progress: https://github.com/orgs/NixOS/projects/30108 Servers

Load older messages


SenderMessageTime
28 May 2025
@emilazy:matrix.orgemilyuntil minimal bootstrap at least :)12:00:27
@raboof:matrix.orgraboofI could see building an 'evil 25.05 image' that'd insert malware when I'd build the ISO on it. It's much harder to see someone in 2020 building an 'evil 20.03 image' that inserts malware when I build the ISO on it in 202512:00:30
@raboof:matrix.orgraboofnot theoretically impossible, of course, which is why bootstrappable builds are still also important, but given the choice building on an 'old' image seems slightly safer than building on a recent image.12:02:51
29 May 2025
@charles:hax0rbana.orgch joined the room.17:26:44
30 May 2025
@fricklerhandwerk:matrix.orgfricklerhandwerkMinimal bootstrap is one cross-compilation of gcc-i686 -> gcc-x86_64 away08:05:37
@fricklerhandwerk:matrix.orgfricklerhandwerkAnyone up to the task?08:05:46
7 Jun 2025
@grimmauld:grapevine.grimmauld.deGrimmauld (any/all) joined the room.11:25:17
@deeok:matrix.orgmatrixrooms.info mod bot (does NOT read/send messages and/or invites; used for checking reported rooms) left the room.22:44:09
@deeok:matrix.orgmatrixrooms.info mod bot (does NOT read/send messages and/or invites; used for checking reported rooms) joined the room.22:56:10
9 Jun 2025
@raboof:matrix.orgraboofIs there an issue to read up on that somewhere? (not that I have time to start digging into that, but good to have the reference)10:00:38
@raboof:matrix.orgraboofmight make sense to explicitly make bootstrappable builds on-topic here as well, https://github.com/NixOS/reproducible.nixos.org/pull/810:01:30
@grimmauld:grapevine.grimmauld.deGrimmauld (any/all)Btw currently taking a look at the lambda ordering issue in https://github.com/NixOS/nixpkgs/issues/230290, trying to repro and diff the generated c code instead of diffing the binary, in a minimal repro.10:09:43
@grimmauld:grapevine.grimmauld.deGrimmauld (any/all)no guarantees, but i have time and this looks like "fun"10:10:31
@raboof:matrix.orgraboofoh cool10:15:02
@raboof:matrix.orgraboofthat's the most long-standing issue for the graphical installer (https://github.com/orgs/NixOS/projects/30) and indeed looks like an interesting rabbithole :)10:16:00
@grimmauld:grapevine.grimmauld.deGrimmauld (any/all)

I just tested the naive way:

delegate void SumLambdaType (int a);

void main () {
    SumLambdaType sum0 = (a) => { print("%d\n", a + 0); };
    SumLambdaType sum1 = (a) => { print("%d\n", a + 1); };
    SumLambdaType sum2 = (a) => { print("%d\n", a + 2); };
    SumLambdaType sum3 = (a) => { print("%d\n", a + 3); };
    SumLambdaType sum4 = (a) => { print("%d\n", a + 4); };
    SumLambdaType sum5 = (a) => { print("%d\n", a + 5); };
    SumLambdaType sum6 = (a) => { print("%d\n", a + 6); };
    SumLambdaType sum7 = (a) => { print("%d\n", a + 7); };
    SumLambdaType sum8 = (a) => { print("%d\n", a + 8); };
    SumLambdaType sum9 = (a) => { print("%d\n", a + 9); };

    sum0(42);
    sum1(42);
    sum2(42);
    sum3(42);
    sum4(42);
    sum5(42);
    sum6(42);
    sum7(42);
    sum8(42);
    sum9(42);
}

Sadly that is still fully deterministic.... It might be because multiple files? not sure yet.

10:36:13
@grimmauld:grapevine.grimmauld.deGrimmauld (any/all)it might also be because inline, so names are not clear thus sorting is unreliable? Not sure yet.10:40:45
@raboof:matrix.orgraboofIIRC it was also not super easy to trigger10:50:07
@grimmauld:grapevine.grimmauld.deGrimmauld (any/all)i mean, ibus triggers it10:51:28
@grimmauld:grapevine.grimmauld.deGrimmauld (any/all)the goal is to find something minimal that triggers it10:51:40
@grimmauld:grapevine.grimmauld.deGrimmauld (any/all)and this was just a naive blind guess to see if it was easy, and turns out that no it isn't10:52:00
@raboof:matrix.orgraboofright, but iirc ibus needs a fair number of rebuilds to actually hit the problem11:15:47
@fricklerhandwerk:matrix.orgfricklerhandwerkThe main chunk of work happened in 2023 here: https://github.com/NixOS/nixpkgs/pull/227914 All of this stuff works now except cross-compiling GCC to 64 bit, which should merely involve setting the right flags11:39:05
@raboof:matrix.orgraboofI'll admit it's not clear to me how all that works in practice ;) - would that allow us to create, say, a qemu disk image with only sources (and those 256b) on it that'd when 'booted' bootstrap itself to a functional shell? or is that not the idea?13:42:14
@julienmalka:matrix.orgJulienI think the assumptions are: Nix + a running kernel + those 256b allows you to build all nixpkgs13:53:23
@julienmalka:matrix.orgJulienObviously the assumptions are broken at multiple places in nixpkgs when other binary blobs are downloaded13:53:50
@emilazy:matrix.orgemilyin particular I believe the goal is to produce a bootstrap tools tarball from those13:59:01
@emilazy:matrix.orgemilythat can replace the current "mystery meat" one13:59:11
@emilazy:matrix.orgemilyso that the bootstrap tools could be audited more easily13:59:22
@raboof:matrix.orgraboof wrt 'other binary blobs', ideally allowNonSource = false should help with that (assuming all such cases are properly marked, which is probably not fully the case ;) ) 14:00:09

Show newer messages


Back to Room ListRoom Version: 6