fluidattacks / makes

A software supply chain framework powered by Nix.
https://makes.fluidattacks.tech/
MIT License
455 stars 43 forks source link

Support Nix Flakes #546

Open kamadorueda opened 3 years ago

kamadorueda commented 3 years ago

Related:

Useful links:

Examples:

Things to take into account:

kamadorueda commented 3 years ago

I'm just gonna drop here two good reasons not to use flakes yet:


  1. It's unstable, which means bugs in the core binary do exist and will sooner or later bite you, no matter what --option xxx yyy, ulimit, etc, you configure to try controlling file descriptor leaks:

image

for some companies like us it's not reasonable to risk reliability on production, the thing must just work, preferably for ever

on Nix stable this too-many-open-files do not happen (downgrading from Flakes was actually the fix to the problem)


  1. Evaluation cache is awesome on flakes, but runtime cache-ability is not perfect yet, for instance we cannot make use of projectPath or something similar:

image

which means that in a tree like following:

if whatever-code changes, then the entire inputs.self.sourceInfo.outPath changes, and thus ./b/c.sh changes, and ./b/d.nix must be build again. This does not happen on Makes using Nix stable because using projectPath you can make d.nix depend only on the NAR serialization of b folder, and changes outside of b do not require to rebuild d.nix.

Maybe this is the reason why some nix experts are using Bazel to achieve incremental builds?

We achieved incremental builds at Fluid Attacks using nix stable and projectPath only


I'm gonna stop working towards Flakes for now

The work done so far serves as a draft on how compatibility with Flakes can be implemented

Ten0 commented 11 months ago

2. runtime cache-ability is not perfect yet, for instance we cannot make use of projectPath or something similar:

Unless I'm mistaken this is fixed the next day by https://github.com/fluidattacks/makes/commit/2143be2f8f00ac6ef530d029e72dc71f59d7a001, correct?