A NixOS ISO becomes fully reproducible
Summary
NixOS developers report a bit-for-bit reproducible minimal ISO, demonstrating verifiable build paths for complete system images. The minimal x86-64 ISO from NixOS unstable became reproducible. Several independent builds produced the same artefact.
Ideas
- Nix describes dependencies and build steps declaratively.
- Pinned inputs limit differences between build environments.
- Deterministic timestamps prevent unnecessary binary differences.
- Independent builds can produce identical hash values.
Insights
- Reproducibility turns trust in a vendor's process into verifiable agreement.
- Deterministic individual packages are not automatically enough for a complete image.
- Bit-identical results make manipulation visible but do not prevent it on their own.
Recommendations
- Build release artefacts on at least two independent systems.
- Publish inputs, tool versions and expected hash values.
References
Links to the original source and the Web Archive open in a new tab.