TL;DR
Nix achieves reproducibility through an input-addressed model, where output paths are derived from build recipes rather than output bytes. However, it can only guarantee repeatability, not bit-for-bit reproducibility without complete derivations.
✦ Why It Matters
Ensure your Nix derivations are complete to achieve true reproducibility in your builds.
Key Takeaways
How It Works
Nix achieves reproducibility by deriving output hashes from build recipes rather than the output itself. However, when additional paths are mounted in the sandbox, they can introduce hidden inputs that alter the build's behavior.
This can lead to different outputs from the same derivation, undermining the expected repeatability.
⚠ The Catch
The sandbox-paths are not included in the derivation, making them a hidden input that can lead to non-deterministic builds. This lack of visibility can result in different users experiencing different outputs from the same derivation, complicating shared binary caches.
Related