The NixOS 24.11 surge and the shift toward reproducible builds

The NixOS 24.11 Surge

The NixOS 24.11 release, also known as Vicuna, arrived with 2669 contributors who authored 49079 commits since the previous release. This surge in participation compares to the 2491 contributors in version 24.05. The release adds 8141 new packages and 20975 updated packages to the Nixpkgs repository, while removing 3970 packages to maintain a secure and manageable set. It also introduces 119 new modules and 1706 new options, while removing 30 modules and 556 options. GNOME 47, nicknamed "Denver," provides users with accent colors, screen capture hardware encoding, and small screen support. Plasma 6.2 provides various bug fixes and changes to the desktop environment. Tristan Ross made changes to LLVM 19 to improve how the system provides multiple versions of the tool. In the package set, python3.pkgs.sequoia was replaced by python3.pkgs.pysequoia to use the dedicated upstream repository for Python bindings. The release also notes the removal of chromiumBeta and google-chrome-beta due to lack of maintenance. Users of writeTextFile must now provide a boolean for the executable option, or the evaluation will fail. Additionally, the boot.loader.raspberryPi options are marked for removal in this version, and services.postgresql.ensurePermissions has been deprecated in favor of services.postgresql.ensureUsers.*.ensureDBOwnership to simplify database ownership setup.

The Guix and Homebrew Dilemma

Teams evaluating declarative Linux distributions often weigh the Nix expression language against the Lisp-based configuration of Guix. Guix provides a system that functions like Mod Organizer, as it builds a virtual filesystem that loads the base files before linking in mods. I find the Guix emphasis on free software compelling, but the project’s refusal to support non-free software like proprietary wifi firmware, Nvidia graphics cards, or Steam forces many users to use the nonguix channel. Guix also lacks macOS support, which requires users to rely on virtual machines to access its functionality. Nix users often use nix-homebrew to manage macOS casks, but a regression in the default brew-src pin to version 5.1.7 breaks darwin-rebuild switch for many. This error in the process_depends_on method occurs because value.keys.first returns nil when the API provides an empty object, which then causes the script to attempt calling to_sym on a null value during the activation phase. This error impacts users attempting to install casks such as wezterm, discord, visual-studio-code, or jetbrains-toolbox. You should add an override in your flake.nix to point inputs.brew-src.url to the Homebrew master branch to avoid this crash. Nix users who want to manage their home directory configuration use home-manager to symlink dotfiles, as the default Nix behavior sets the HOME directory to /homeless during derivation builds.

Deployment and Reproducibility

NixOS allows teams to unify package management and ensure development environments match production environments 1:1. This capability addresses the complexity of managing diverse Docker images and multiple Kubernetes configuration files across various departments. One deployment method uses a NixOS module to manage a Podman container stack that includes a FastAPI backend and a React frontend. The system uses a systemd path unit to watch for a trigger file on a shared volume. When a user clicks an upgrade button in the UI, the backend writes a JSON file to /data/upgrade-requested on the host. The host then runs a script that performs five specific steps: it tars the SQLite database, configuration, and env files for backup; it pulls the backend image with a 5-minute timeout; it pulls the frontend image; it restarts the services; and it performs a health check by curling /api/health.

The package manager builds all software in isolation by setting the HOME directory to /homeless. This isolation supports the reproducibility goals seen in projects like Debian, where users can bootstrap a minimal Trixie environment using 100% reproducible packages. However, Guix users reported a reproducibility issue where pytorch results varied on AVX512 compared to AVX2 hardware. The backend in a containerized NixOS deployment must hit the https://ghcr.io/token endpoint to obtain a bearer token for the v2 API. This process allows the container to pull images even when the registry requires token exchange for anonymous access. Does the community find a way to solve the issue where users running old versions struggle to identify which release they are using?