nixpkgs VS nonguix

https://github.com/NixOS/nixpkgs/commits?author=neon-sunset

I see two signers in the top 6 displayed on https://github.com/NixOS/nixpkgs/graphs/contributors

For a single file script, nix can make the package management quite easy: https://github.com/NixOS/nixpkgs/blob/master/doc/languages-f...

For example,

```

Yes, Nix doesn't actually ensure that the builds are deterministic. In fact it works just fine if they aren't. There are packages in nixpkgs that aren't reproducible: https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aiss...

I'm not familiar with Bazel, but Nix in it's current form wouldn't have solved this attack. First of all, the standard mkDerivation function calls the same configure; make; make install process that made this attack possible. Nixpkgs regularly pulls in external resources (fetchUrl and friends) that are equally vulnerable to a poisoned release tarball. Checkout the comment on the current xz entry in nixpkgs https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/comp...

NixOS uses a monorepo and I think everyone's love it.

I love being able to easily grep through all the packages source code and there's regularly PRs that harmonizes conventions across many packages.

Nixpkgs doesn't include the packaged software source code, so it's a lot more practical than what Debian is doing.

https://github.com/NixOS/nixpkgs

In this specific case, nix uses fetchFromGitHub to download the source archive, which are generated by GitHub for the specified revision[1]. Arch seems to just download the tarball from the releases page[2].

[1]: https://github.com/NixOS/nixpkgs/blob/3c2fdd0a4e6396fc310a6e...

[2]: https://gitlab.archlinux.org/archlinux/packaging/packages/ib...

True, but irrelevant -- _some packages_, _somewhere_, do depend on xz, which, if built, requires pulling the source from GitHub (see the default.nix: https://github.com/NixOS/nixpkgs/blob/nixos-23.11/pkgs/tools...)

It's not the vulnerability that's a problem right now (NixOS was protected by a couple of factors) but rather GitHub's hamfisted response.

That is the problem.

We’ve noticed that some users have been asking about how to use older versions of Terraform in their Nix setups [1, 2]. This is an example of the diverse needs of people and the importance of maintaining backward compatibility. We hope that nixpkgs-terraform will be a useful tool for these users.

I use the nonguix channel for non-free stuff https://gitlab.com/nonguix/nonguix. It has the mainline linux kernel (instead of the free linux-libre), proprietary drivers and a bunch of other proprietary stuff.

Guix has these things called "channels" containing package definitions. They're actually just git repositories. nonguix was made to have nonfree stuff. It has a lot of stuff including the mainline linux kernel.

https://gitlab.com/nonguix/nonguix you can use non free software if you need to. But the project itself is a gnu project and as such should not encourage users to use non free software.

I think Guix approach is good, community helps with open-source packages, some third-party manages the non-free channels. And they are as easy to use

https://gitlab.com/nonguix/nonguix

There are flatpacks, snaps, appimages, PPAs, channels... why would you except a linux distro maintainer to work for free for a billion dollar company? Testing and maintain their software

My background consists of using/developing Guix, openSUSE/SUSE as well of OBS. I'm a co-maintainer at nonguix, where we provide non-free software which is not allowed at upstream Guix. We even run our own little build service, called Cuirass. This softwore is developed mostly by https://www.reddit.com/user/mothacehe/ :)

$ guix describe Generation 22 May 15 2022 19:02:44 (current) guix 9860c90 repository URL: https://git.savannah.gnu.org/git/guix.git branch: master commit: 9860c90e8e5362e0e843efbd45f4563b9746a196 guix-gaming-games 9924ad0 repository URL: https://gitlab.com/guix-gaming-channels/games.git branch: master commit: 9924ad0a66f98ea1b538761fd49521acf4f689a3 flat 094746c repository URL: https://github.com/flatwhatson/guix-channel.git branch: master commit: 094746c1e2e90f2df1e598ab1fd0abb4d75ce84d nonguix 1de0c32 repository URL: https://gitlab.com/nonguix/nonguix branch: master commit: 1de0c32142c54bc73af5556d5e45c77152b31f0f

Thanks for the link. Although I was just planning to follow the steps in the https://gitlab.com/nonguix/nonguix repo.

You'll want to read about "channels" which are additional software repositories you can include in Guix from anywhere, There are other channels, but the main one for non-free is https://gitlab.com/nonguix/nonguix

Even GNU Guix System (which is a fully libre, FSF approved distro) can be used to install non-free packages. All you have to do is add the nonguix repository.