The developers of the NixOS distribution announced the implementation of integrity verification support for the minimal ISO image (iso_minimal.x86_64-linux) using the reproducible builds mechanism. Previously, reproducible builds were available at the individual package level, but have now been extended to the entire ISO image. Any user can create an ISO image that is fully identical to the one provided for download, ensuring it is built from the provided source texts and contains no hidden changes. A special script has been prepared to automate the verification of the NixOS ISO image using reproducible builds. The next step is to provide reproducible builds for the full ISO image with the GNOME desktop.
Reproducible builds are a crucial part of ensuring security, as they allow users to independently verify that the binaries offered by the distribution match byte-for-byte with the builds compiled directly from the source texts. Without the ability to verify the identity of the binary build, users are left to trust blindly in someone else's build infrastructure, the compromise of which may lead to the insertion of hidden backdoors. Ensuring reproducible builds requires replicating the build environment setup and parameters, using identical versions of programs, dependencies, and boot components, eliminating the inclusion of variable data (timestamps, random fillers, etc.), and maintaining the order of file assembly and package delivery in the ISO image.
As a reminder, the NixOS distribution is based on the Nix package manager and offers several in-house developments that simplify system setup and maintenance. For example, NixOS uses a single system configuration file (configuration.nix), allows for quick rollbacks of updates, supports switching between different system states, enables users to install individual packages (with packages placed in the home directory), and allows simultaneous installation of multiple versions of the same program. When using Nix, packages are installed in a separate directory tree /nix/store or in a subdirectory in the user's folder. For instance, a package is installed as /nix/store/f2b5…8a563-firefox-89.0.1/, where "f2b5…" is a unique package identifier used for dependency management.
Packages are structured as containers that include all necessary components for applications to function. Dependencies can be defined between packages, and to check for already installed dependencies, hash identifiers in the installed packages directory are scanned. Both pre-built binary packages can be downloaded from the repository (only delta changes are downloaded when updating binary packages) and building from source with all dependencies are possible. The package collection is available in the special Nixpkgs repository.
Source: opennet.ru
