[reinitctxoffset]

I understand in considerable detail what's happening here, having written a conforming implementation of `nix` myself.

Silently smuggling environment variables into a builder means the build is not reproducible, nor is it possible to know a-priori whether the build is reproducible. Nix reverts to the same level of guarantee you get from Ubuntu or whatever without the convenience of Ubuntu: Docker is dramatically more principled!

The galaxy brain people who do real mathematics of whom I am merely a humble fan worked this one out. The credential is a "coffect", which is a generalization of this sort of thing that is tracked ("graded") and accounted for ("discharged"), a process that allows you to reason about your system (to for example know that a massive build is going to be useless before you do it since you don't have the credential for the model you were trying to run with the thing you built).

Punching random holes in Nix is worse than just disabling the sandbox or whatever other BDSM thing, because if you aren't going to get correct you might as well get easy.

Why put up with Nix's bullshit if it's still going to be less correct than Docker anyways? Most people agree (c.f. Docker as opposed to Nix winning too hard in the market).

My approach is different: unfuck Nix.

[arianvanp]

Euhm what the hell are you on about. This is a fixed output derivation. The output per definition is reproducible. It either returns a value that matches the hash or it fails.

The whole point is that it allows introducing controlled side effects as long as the output is reproducible.

Bur you're extremely annoying to talk to so I'm not gonna continue engaging. Probably an LLM

[reinitctxoffset]

The outcome isn't even reproducible if GitHub is down, so like multiple times a week now. And FODs routinely break because of the dozens of leakage modes in the evaluation cache (if flakes are involved), the dozens of races (mostly TOCTOU or adjacent) on the `sqlite` interface and other store-adjacent bugs (`ssh-ng` is especially broken, that's actually the biggest blocker to floating CA at the moment), and so it is very easy to change the declared hash of a fixed-output derivation (for example, you're iterating on the upstream artifact) and have an old one stuck in cache/store because the `Aterm` driving the NAR calculation doesn't trip a fetcher invoke.

This stuff doesn't work, and mixing in ambient environment state is the cross product of the current amount of broken with now it's not even the same on my laptop and desktop.

If you know of an LLM that understands this stuff in this kind of detail, I would be in your debt for a referral, because I sure as hell wish I didn't have to know all this stuff.

And if it's annoying to make vague claims without supporting evidence and have them refuted by concrete arguments with specific details cited than HN may not be the place for you. Being right matters here. I haven't been rude, or made it personal (vis-a-vis "you're extremely annoying" which I don't appreciate).

I don't get the personal attack on this. I'm talking facts about technology.