by jchw | 2025-05-13 01:54:48+00:00
Reproducible builds really are orthogonal to Nix, even if it seems like they're not. Nix was not built with reproducible builds in mind, and the problems it solves are ultimately independent even though they are related in some ways. The Nix PhD thesis by Eelco Dolstra, the founder of Nix, lays out the motivations for Nix very plainly. I decided I'd probably be better off quoting it directly than summarizing it poorly, so here goes:

From The Purely Functional Software Deployment Model, "1.3. Motivation"[1]:

From the previous discussion of existing deployment systems it should be clear that they lack important features to support safe and efficient deployment. In particular, they have some or all of the following problems: • Dependency specifications are not validated, leading to incomplete deployment. • Dependency specifications are inexact (e.g., nominal). • It is not possible to deploy multiple versions or variants of a component side-by-side. • Components can interfere with each other. • It is not possible to roll back to previous configurations. • Upgrade actions are not atomic. • Applications must be monolithic, i.e., they must statically contain all their depen- dencies. • Deployment actions can only be performed by administrators, not by unprivileged users. • There is no link between binaries and the sources and build processes that built them. • The system supports either source deployment or binary deployment, but not both; or it supports both but in a non-unified way. • It is difficult to adapt components. • Component composition is manual. • The component framework is narrowly restricted to components written in a specific programming language or framework. • The system depends on non-portable techniques. The objective of the research described in this thesis is to develop a deployment system that does not have these problems.

Of course, part of the reason why reproducible builds was not considered for this is probably because it was simply not a hot topic at the time (had the term 'reproducible builds' even been coined yet?) and there were much bigger fish to fry with package management than reproducibility at that time, considering how relatively poorly packages were specified. Since then, "traditional" package managers and package repositories have put substantial work into cleaning up their package manifests and ensuring that they have accurate dependencies and other specifications such that today highly reproducible systems can be and have been built on top of them, limitations from the lack of hermetic guarantees notwithstanding.

Despite this, because Nix does guarantee bit-exact external inputs to a derivation, it does indeed make an excellent starting point for reproducible builds, but Nix itself as a tool is definitely orthogonal to reproducible builds, as it solves an entirely different problem that just happens to be related. You don't need the purity guarantees Nix gives you to get reproducible builds, and having those purity guarantees don't automatically give you reproducible builds (though as seen by Nixpkgs, it isn't uncommon for a build to coincidentally be reproducible just as a result of packaging it into a Nix derivation... just, not really specifically guaranteed by anything.)

[1]: https://edolstra.github.io/pubs/phd-thesis.pdf