{"id":100551,"date":"2021-06-21T10:22:44","date_gmt":"2021-06-21T08:22:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-nixos-obespechena-podderzhka-povtoryaemyh-sborok-dlya-iso-obraza"},"modified":"2021-06-21T10:22:44","modified_gmt":"2021-06-21T08:22:44","slug":"v-nixos-obespechena-podderzhka-povtoryaemyh-sborok-dlya-iso-obraza","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-nixos-obespechena-podderzhka-povtoryaemyh-sborok-dlya-iso-obraza","title":{"rendered":"NixOS provides support for reproducible builds for ISO images.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The developers of the NixOS distribution announced the implementation of integrity verification support for the minimal ISO image (iso_minimal.x86_64-linux) using the reproducible builds mechanism. Previously, reproducible builds were available at the individual package level, but have now been extended to the entire ISO image. Any user can create an ISO image that is fully identical to the one provided for download, ensuring it is built from the provided source texts and contains no hidden changes. A special script has been prepared to automate the verification of the NixOS ISO image using reproducible builds. The next step is to provide reproducible builds for the full ISO image with the GNOME desktop. <\/p>\n
Reproducible builds are a crucial part of ensuring security, as they allow users to independently verify that the binaries offered by the distribution match byte-for-byte with the builds compiled directly from the source texts. Without the ability to verify the identity of the binary build, users are left to trust blindly in someone else's build infrastructure, the compromise of which may lead to the insertion of hidden backdoors. Ensuring reproducible builds requires replicating the build environment setup and parameters, using identical versions of programs, dependencies, and boot components, eliminating the inclusion of variable data (timestamps, random fillers, etc.), and maintaining the order of file assembly and package delivery in the ISO image. <\/p>\n
It is worth noting that the NixOS distribution is based on the Nix package manager and provides a number of its own developments that simplify the configuration and maintenance of the system. For example, NixOS uses a single system configuration file (configuration.nix), allows for quick rollback of updates, supports switching between different system states, enables individual users to install custom packages (with packages installed in the home directory), and allows simultaneous installation of multiple versions of the same program. When using Nix, packages are installed in a separate directory tree \/nix\/store or a subdirectory within the user's directory. For instance, a package is installed as \/nix\/store\/f2b5\u20268a563-firefox-89.0.1\/, where 'f2b5\u2026' is a unique identifier for the package used for dependency tracking. <\/p>\n
Packages are structured as containers that include all necessary components for applications to function. Dependencies can be defined between packages, and to check for already installed dependencies, hash identifiers in the installed packages directory are scanned. Both pre-built binary packages can be downloaded from the repository (only delta changes are downloaded when updating binary packages) and building from source with all dependencies are possible. The package collection is available in the special Nixpkgs repository. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"