Does Functional Package Management Enable Reproducible Builds at Scale? Yes
Julien Malka (ACES, INFRES), Stefano Zacchiroli (ACES, INFRES), Th\'eo Zimmermann (ACES, INFRES)

TL;DR
This large-scale study demonstrates that functional package management with Nix achieves high reproducibility and rebuildability rates across hundreds of thousands of packages, supporting scalable reproducible builds.
Contribution
First extensive analysis of reproducibility at scale in Nix, revealing high success rates and identifying key causes of unreproducibility in large package repositories.
Findings
Reproducibility rates between 69% and 91% with upward trend.
Rebuildability exceeds 99%.
Approximately 15% of failures due to embedded build dates.
Abstract
Reproducible Builds (R-B) guarantee that rebuilding a software package from source leads to bitwise identical artifacts. R-B is a promising approach to increase the integrity of the software supply chain, when installing open source software built by third parties. Unfortunately, despite success stories like high build reproducibility levels in Debian packages, uncertainty remains among field experts on the scalability of R-B to very large package repositories. In this work, we perform the first large-scale study of bitwise reproducibility, in the context of the Nix functional package manager, rebuilding 709 816 packages from historical snapshots of the nixpkgs repository, the largest cross-ecosystem open source software distribution, sampled in the period 2017-2023. We obtain very high bitwise reproducibility rates, between 69 and 91% with an upward trend, and even higher…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
