CLAIMBOUND / SOURCE-PUBLICATION EVIDENCE
Reproducible builds
Every card identifies what it proves, what it does not prove, its exact quote, locator, source hash, and local rerun command.
1. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 3
Narrow public claim
We highlight the wide variability in reproducibility rates across ecosystems packaged in nixpkgs, and show the significant impact that some core packages can have on the overall reproducibility rate of an ecosystem.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 3- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
We highlight the wide variability in reproducibility rates across ecosystems packaged in nixpkgs, and show the significant impact that some core packages can have on the overall reproducibility rate of an ecosystem.
2. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 3
Narrow public claim
Section III gives some background that is required to understand the experiment, whose methodology is then presented in Section IV.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 3- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Section III gives some background that is required to understand the experiment, whose methodology is then presented in Section IV.
3. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 3
Narrow public claim
Some descriptive statistics about the dataset are presented in Section V, and the results to our RQs in Section VI.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 3- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Some descriptive statistics about the dataset are presented in Section V, and the results to our RQs in Section VI.
4. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 3
Narrow public claim
Reproducible builds (R-B) R-B are a relatively recent concept, which has been picked up and developed mostly by practitioners from Linux distributions and upstream maintainers.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 3- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Reproducible builds (R-B) R-B are a relatively recent concept, which has been picked up and developed mostly by practitioners from Linux distributions and upstream maintainers.
5. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 3
Narrow public claim
The Reproducible Builds project [32] has been the main actor in the area.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 3- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The Reproducible Builds project [32] has been the main actor in the area.
6. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 3
Narrow public claim
The project has produced a definition of R-B, best practices to achieve them, and tools to monitor the reproducibility of software distributions, and debug unreproducibilities (the diffoscope).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 3- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The project has produced a definition of R-B, best practices to achieve them, and tools to monitor the reproducibility of software distributions, and debug unreproducibilities (the diffoscope).
7. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 3
Narrow public claim
An alternative technique to achieve build reproducibility is proposed by Navarro et al. [23].
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 3- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
An alternative technique to achieve build reproducibility is proposed by Navarro et al. [23].
8. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 3
Narrow public claim
FPMs such as Nix [12] and Guix [7] are also presented as a way to achieve R-B.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 3- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
FPMs such as Nix [12] and Guix [7] are also presented as a way to achieve R-B.
9. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 3
Narrow public claim
Malka et al. [21] showed that Nix allows reproducing past build environment reliably, as well as rebuilding old packages with high confidence, but they do not address the question of bitwise reproducibility, which we do with this work. c) Relaxing the bitwise reproducibility criterion: Because of the difficulty (real or perceived) to achieve bitwise reproducibility, some authors have proposed to relax the criterion to a more practical one.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 3- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Malka et al. [21] showed that Nix allows reproducing past build environment reliably, as well as rebuilding old packages with high confidence, but they do not address the question of bitwise reproducibility, which we do with this work. c) Relaxing the bitwise reproducibility criterion: Because of the difficulty (real or perceived) to achieve bitwise reproducibility, some authors have proposed to relax the criterion to a more practical one.
10. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 3
Narrow public claim
For instance, accountable builds [27] aim to distinguish between differences that can be explained (accountable differences) or not (unaccountable differences).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 3- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For instance, accountable builds [27] aim to distinguish between differences that can be explained (accountable differences) or not (unaccountable differences).
11. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 4
Narrow public claim
Our work is similar, but instead of relying on historical R-B tracking, we actually rebuildpackages andcomparethembitwise tohistoricalbuild results.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 4- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Our work is similar, but instead of relying on historical R-B tracking, we actually rebuildpackages andcomparethembitwise tohistoricalbuild results.
12. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 4
Narrow public claim
When we report on packages being reproducible, it means they have stood the test of time.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 4- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
When we report on packages being reproducible, it means they have stood the test of time.
13. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 4
Narrow public claim
Combining the historical snapshot approach of our work with their approach of varying the configuration options could be an interesting future work.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 4- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Combining the historical snapshot approach of our work with their approach of varying the configuration options could be an interesting future work.
14. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 4
Narrow public claim
More specifically, nixpkgs is the basis of the NixOS Linux distribution.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 4- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
More specifically, nixpkgs is the basis of the NixOS Linux distribution.
15. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 4
Narrow public claim
Nix packages are viewed as pure functions from their inputs (source code, dependencies, build scripts) to their outputs (binaries, documentation, etc.).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 4- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Nix packages are viewed as pure functions from their inputs (source code, dependencies, build scripts) to their outputs (binaries, documentation, etc.).
16. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 4
Narrow public claim
Any change to the inputs should produce a different package version.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 4- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Any change to the inputs should produce a different package version.
17. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 4
Narrow public claim
Nix evaluation-build pipeline Building binary outputs from a Nix package recipe is a two-step process.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 4- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Nix evaluation-build pipeline Building binary outputs from a Nix package recipe is a two-step process.
18. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 4
Narrow public claim
First, Nix evaluates the expression and transforms it into a derivation, an intermediary representation in the Nix store containing all the necessary information to run the build process.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 4- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
First, Nix evaluates the expression and transforms it into a derivation, an intermediary representation in the Nix store containing all the necessary information to run the build process.
19. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 4
Narrow public claim
In particular, the derivation contains ahead of time the (input-addressed) output path, that is the exact location in the Nix store where the build artifacts will be stored if that derivation were to be built.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 4- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
In particular, the derivation contains ahead of time the (input-addressed) output path, that is the exact location in the Nix store where the build artifacts will be stored if that derivation were to be built.
20. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 4
Narrow public claim
In the same fashion as other Linux distributions, Nix packages may produce multiple outputs (a main output with binaries, one with documentation, etc.).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 4- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
In the same fashion as other Linux distributions, Nix packages may produce multiple outputs (a main output with binaries, one with documentation, etc.).
21. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 4
Narrow public claim
Each output has its own directory in the Nix store, and building the derivation from source systematically produces all its outputs.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 4- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Each output has its own directory in the Nix store, and building the derivation from source systematically produces all its outputs.
22. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 4
Narrow public claim
Path substitution and binary caches Alternatively to building from source, Nix offers the option to download prebuilt artifacts from third party binary caches, which are databases populated with build outputs generated by Nix.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 4- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Path substitution and binary caches Alternatively to building from source, Nix offers the option to download prebuilt artifacts from third party binary caches, which are databases populated with build outputs generated by Nix.
23. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 5
Narrow public claim
The nixpkgs continuous integration Hydra [13] is the continuous integration (CI) platform for the nixpkgs project.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 5- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The nixpkgs continuous integration Hydra [13] is the continuous integration (CI) platform for the nixpkgs project.
24. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 5
Narrow public claim
At regular intervals in time, it fetches the latest version of nixpkgs’ git master branch and evaluates the pkgs/top-level/release.nix file embedded in the repository.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 5- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
At regular intervals in time, it fetches the latest version of nixpkgs’ git master branch and evaluates the pkgs/top-level/release.nix file embedded in the repository.
25. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 5
Narrow public claim
Diffoscope Diffoscope [11] is a tool developed and maintained by the Reproducible Builds project that aims to simplify the analysis of differences between software artifacts.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 5- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Diffoscope Diffoscope [11] is a tool developed and maintained by the Reproducible Builds project that aims to simplify the analysis of differences between software artifacts.
26. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 5
Narrow public claim
It generates HTML or JSON artifacts—also called diffoscopes—that can be either interpreted by humans or automatically processed.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 5- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
It generates HTML or JSON artifacts—also called diffoscopes—that can be either interpreted by humans or automatically processed.
27. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 5
Narrow public claim
Since building revisions, as opposed to just evaluating them, is very computationally intensive, it was not feasible to build all 200 revisions.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 5- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Since building revisions, as opposed to just evaluating them, is very computationally intensive, it was not feasible to build all 200 revisions.
28. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 5
Narrow public claim
Also, it was difficult to correctly estimate how many revisions we could build, due to the ever-growing number of packages in each revision.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 5- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Also, it was difficult to correctly estimate how many revisions we could build, due to the ever-growing number of packages in each revision.
29. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 5
Narrow public claim
Our infrastructure has two types of machines: a coordinator and multiple builders.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 5- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Our infrastructure has two types of machines: a coordinator and multiple builders.
30. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 5
Narrow public claim
The coordinator is in charge of distributing the workload and storing data that must be persisted, while the builders are stateless and perform workloads sent by the coordinator.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 5- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The coordinator is in charge of distributing the workload and storing data that must be persisted, while the builders are stateless and perform workloads sent by the coordinator.
31. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 5
Narrow public claim
The release.nix file is human crafted and does not contain all the dependencies of the listed packages, even though they are built by Hydra along the way.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 5- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The release.nix file is human crafted and does not contain all the dependencies of the listed packages, even though they are built by Hydra along the way.
32. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 5
Narrow public claim
This is required to compare our build outputs with historical results for bitwise reproducibility.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 5- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
This is required to compare our build outputs with historical results for bitwise reproducibility.
33. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 5
Narrow public claim
Derivations missing from the cache can indicate that they historically failed to build, although there can be other reasons for their absence.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 5- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Derivations missing from the cache can indicate that they historically failed to build, although there can be other reasons for their absence.
34. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 6
Narrow public claim
Ecosystem identification and package tracking To answer RQ1, RQ2 and RQ4, we need to be able to discriminate packages by provenance ecosystem, and track them over time to follow their evolution.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 6- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Ecosystem identification and package tracking To answer RQ1, RQ2 and RQ4, we need to be able to discriminate packages by provenance ecosystem, and track them over time to follow their evolution.
35. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 6
Narrow public claim
To categorize packages by ecosystem, we rely on the first component of the package name when it has several components (for example a package named haskellPackages.network is sorted into the Haskell ecosystem).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 6- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
To categorize packages by ecosystem, we rely on the first component of the package name when it has several components (for example a package named haskellPackages.network is sorted into the Haskell ecosystem).
36. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 6
Narrow public claim
For instance, the following ecosystems were merged into a single one: php56Packages, php70Packages, ..., php82Packages, phpExtensions, phpPackages and phpPackages-unit.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 6- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For instance, the following ecosystems were merged into a single one: php56Packages, php70Packages, ..., php82Packages, phpExtensions, phpPackages and phpPackages-unit.
37. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 6
Narrow public claim
We then investigate whether we can use our large dataset of diffoscopes for automatic detection of causes of nonreproducibility.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 6- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
We then investigate whether we can use our large dataset of diffoscopes for automatic detection of causes of nonreproducibility.
38. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 6
Narrow public claim
We then run these heuristics on the full diffoscope dataset to determine the proportion of packages impacted by each cause (multiple causes can apply to the same package).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 6- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
We then run these heuristics on the full diffoscope dataset to determine the proportion of packages impacted by each cause (multiple causes can apply to the same package).
39. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 6
Narrow public claim
The first and last author then evaluate the precision of each these heuristics by manually counting false positives in samples of matched lines for each heuristic.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 6- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The first and last author then evaluate the precision of each these heuristics by manually counting false positives in samples of matched lines for each heuristic.
40. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 7
Narrow public claim
These are our candidate packages (and “old” and “new” commits) for the bisection process.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 7- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
These are our candidate packages (and “old” and “new” commits) for the bisection process.
41. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 7
Narrow public claim
Commits that fail to build or are not available in cache are marked as “skipped”.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 7- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Commits that fail to build or are not available in cache are marked as “skipped”.
42. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 7
Narrow public claim
We manually inspect the pull request (description, commit log, code changes) to first confirm that the bisect phase successfully identified the commit that fixed the reproducibility failure.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 7- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
We manually inspect the pull request (description, commit log, code changes) to first confirm that the bisect phase successfully identified the commit that fixed the reproducibility failure.
43. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 7
Narrow public claim
Once we have confirmed that the identified commit is correct, we check whether the commit authors indicate that they are fixing a reproducibility issue and if the commit is a package update or another change.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 7- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Once we have confirmed that the identified commit is correct, we check whether the commit authors indicate that they are fixing a reproducibility issue and if the commit is a package update or another change.
44. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 7
Narrow public claim
In this paper, we use the dataset to answer our stated research questions, but many other research questions could be addressed using the dataset, including more in-depth analysis of nonreproducibility causes.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 7- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
In this paper, we use the dataset to answer our stated research questions, but many other research questions could be addressed using the dataset, including more in-depth analysis of nonreproducibility causes.
45. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 7
Narrow public claim
From those builds, 548390 are coming directly from the release.nix file and can be tracked by name.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 7- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
From those builds, 548390 are coming directly from the release.nix file and can be tracked by name.
46. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 7
Narrow public claim
The three largest ecosystems are Haskell, Python and Perl, which together account for 42.4% of the packages.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 7- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The three largest ecosystems are Haskell, Python and Perl, which together account for 42.4% of the packages.
47. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 7
Narrow public claim
In particular, as of July 2017 the package set contained 13114 elements, 8929 of which were still present in April 2023.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 7- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
In particular, as of July 2017 the package set contained 13114 elements, 8929 of which were still present in April 2023.
48. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 9
Narrow public claim
The minimal ISO image has a very high proportion of reproducible packages in the considered period, with rates consistently higher than 95% starting from May 2019.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 9- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The minimal ISO image has a very high proportion of reproducible packages in the considered period, with rates consistently higher than 95% starting from May 2019.
49. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 9
Narrow public claim
Its reproducibility rates however do not follow the evolution of the overall package set, such that observing the reproducibility of the minimal ISO image does not give any clue about the reproducibility of the package set as a whole.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 9- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Its reproducibility rates however do not follow the evolution of the overall package set, such that observing the reproducibility of the minimal ISO image does not give any clue about the reproducibility of the package set as a whole.
50. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 10
Narrow public claim
While the real host name is hidden by the Nix sandbox, other pieces of information (such as the Linux kernel version or OS version, reported by uname) are still available.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 10- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
While the real host name is hidden by the Nix sandbox, other pieces of information (such as the Linux kernel version or OS version, reported by uname) are still available.
51. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 10
Narrow public claim
Altogether, a total of 19.7% of the packages for which we have generated a diffoscope have an unreproducibility that can be explained by at least one of our heuristics.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 10- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Altogether, a total of 19.7% of the packages for which we have generated a diffoscope have an unreproducibility that can be explained by at least one of our heuristics.
52. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 10
Narrow public claim
We evaluate the precision of each heuristic by manually verifying 500 matched lines for every heuristic and counting false positives.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 10- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
We evaluate the precision of each heuristic by manually verifying 500 matched lines for every heuristic and counting false positives.
53. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 10
Narrow public claim
For the uname, build ID, and environment variables heuristics, we report a precision of 100%.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 10- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For the uname, build ID, and environment variables heuristics, we report a precision of 100%.
54. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 10
Narrow public claim
In fact, in 76 cases we found out that the reproducibility fix was just a routine package update, and it is very likely that the package becoming reproducible had more to do with changes in the upstream software than with a conscious action from the package maintainer.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 10- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
In fact, in 76 cases we found out that the reproducibility fix was just a routine package update, and it is very likely that the package becoming reproducible had more to do with changes in the upstream software than with a conscious action from the package maintainer.
55. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 10
Narrow public claim
Other fixes included internal nixpkgs changes that had reproducibility impact as a side effect of the main reason behind the change.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 10- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Other fixes included internal nixpkgs changes that had reproducibility impact as a side effect of the main reason behind the change.
56. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 11
Narrow public claim
False myth: Nix implies bitwise reproducibility: Contradictory to the previous myth, there is also a belief that Nix (or functional package management more generally) implies bitwise reproducibility.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 11- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
False myth: Nix implies bitwise reproducibility: Contradictory to the previous myth, there is also a belief that Nix (or functional package management more generally) implies bitwise reproducibility.
57. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 11
Narrow public claim
Our results disprove this belief: about 9.4% of nixpkgs packages are not bitwise reproducible.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 11- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Our results disprove this belief: about 9.4% of nixpkgs packages are not bitwise reproducible.
58. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 11
Narrow public claim
This is not surprising, because R-B violations happen for multiple reasons, only some of which are mitigated by FPM per se.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 11- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
This is not surprising, because R-B violations happen for multiple reasons, only some of which are mitigated by FPM per se.
59. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 11
Narrow public claim
Recommendation: use FPM for bitwise reproducibility andrebuildability: Still,Nixappearstoperformreallywellat bitwise reproducibility “out of the box”, and even more so at rebuildability (above 99%).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 11- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Recommendation: use FPM for bitwise reproducibility andrebuildability: Still,Nixappearstoperformreallywellat bitwise reproducibility “out of the box”, and even more so at rebuildability (above 99%).
60. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 11
Narrow public claim
Based on this, we recommend to use Nix, or FPM more generally, for all use cases that require either mere rebuildability or full bitwise reproducibility.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 11- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Based on this, we recommend to use Nix, or FPM more generally, for all use cases that require either mere rebuildability or full bitwise reproducibility.
61. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 11
Narrow public claim
This work has investigated the causes of the lingering non reproducibility in nixpkgs, but not those of reproducibility; it would be interesting to know why Nix performs so well, possibly for adoption in different contexts.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 11- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
This work has investigated the causes of the lingering non reproducibility in nixpkgs, but not those of reproducibility; it would be interesting to know why Nix performs so well, possibly for adoption in different contexts.
62. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 11
Narrow public claim
QA monitoring for bitwise reproducibility: The significantly higher (and stably so) bitwise reproducibility performances of the NixOS minimal ISO image (see Figure 13) suggests that quality assurance (QA) monitoring for build reproducibility is an effective way to increase it.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 11- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
QA monitoring for bitwise reproducibility: The significantly higher (and stably so) bitwise reproducibility performances of the NixOS minimal ISO image (see Figure 13) suggests that quality assurance (QA) monitoring for build reproducibility is an effective way to increase it.
63. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 11
Narrow public claim
The fact that Debian uses a similar approach with good results [16] is compatible with this interpretation.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 11- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The fact that Debian uses a similar approach with good results [16] is compatible with this interpretation.
64. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 11
Narrow public claim
This can be improved upon by sampling and rebuilding more nixpkgs revisions, complementing this work.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 11- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
This can be improved upon by sampling and rebuilding more nixpkgs revisions, complementing this work.
65. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 11
Narrow public claim
It would be interesting and possible to measure such impact by, e.g., first trying to download assets from their original hosting places and, for source code assets, fallback to archives such as Software Heritage [6] in case of failure.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 11- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
It would be interesting and possible to measure such impact by, e.g., first trying to download assets from their original hosting places and, for source code assets, fallback to archives such as Software Heritage [6] in case of failure.
66. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 12
Narrow public claim
Neither did we verify historical build reproducibility in classic FOSS distributions (e.g., Debian, Fedora, etc.), as out of the FPM scope.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 12- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Neither did we verify historical build reproducibility in classic FOSS distributions (e.g., Debian, Fedora, etc.), as out of the FPM scope.
67. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 12
Narrow public claim
Doing so would still be interesting, for comparison purposes.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 12- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Doing so would still be interesting, for comparison purposes.
68. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 12
Narrow public claim
We have highlighted disparities in reproducibility across ecosystems that coexist in nixpkgs, as well as between packages for which bitwise reproducibility is actively monitored and the others.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 12- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
We have highlighted disparities in reproducibility across ecosystems that coexist in nixpkgs, as well as between packages for which bitwise reproducibility is actively monitored and the others.
69. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 12
Narrow public claim
A full replication package containing the code used to run the experiment describe in this paper is archived on and available from Software Heritage [20].
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 12- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
A full replication package containing the code used to run the experiment describe in this paper is archived on and available from Software Heritage [20].
70. Does Functional Package Management Enable Reproducible Builds at Scale? Yes · PDF page 12
Narrow public claim
We also thank the NixOS Foundation for guaranteeing us that the revisions that we needed for this research would not be garbage-collected.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- Does Functional Package Management Enable Reproducible Builds at Scale? Yes
- Section locator
PDF page 12- Captured
- 2026-08-11
- Source SHA-256
1cec8d9117720e3fa61a2c448d689c433dff80af39ddd9a950ea396ff5f07ef1- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom012_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
We also thank the NixOS Foundation for guaranteeing us that the revisions that we needed for this research would not be garbage-collected.