Secure sharing between untrusted users in a transparent source/binary deployment model

Abstract

The Nix software deployment system is based on the paradigm of transparent source/binary deployment: distributors deploy descriptors that build components from source, while client machines can transparently optimise such source builds by downloading pre-built binaries from remote repositories. This model combines the simplicity and flexibility of source deployment with the efficiency of binary deployment. A desirable property is sharing of components: if multiple users install from the same source descriptors, ideally only one remotely built binary should be installed. The problem is that users must trust that remotely downloaded binaries were built from the sources they are claimed to have been built from, while users in general do not have a trust relation with each other or with the same remote repositories. This paper presents three models that enable sharing: the extensional model that requires that all users on a system have the same remote trust relations, the intensional model that does not have this requirement but may be suboptimal in terms of space use, and the mixed model that merges the best properties of both. The latter two models are achieved through a novel technique of hash rewriting in content-addressable component stores, and were implemented in the context of the Nix system.

NixOS: A purely functional Linux distribution

“…NixOS has system services for running X11 (including the KDE desktop environment and parts of Gnome), Apache, PostgreSQL, and many more. NixOS is fairly unique among Linux distributions in that it allows non-root users to install software, thanks in part to the purely functional approach, which enables some strong security guarantees (Dolstra 2005).…”

NixOS

“…NixOS has system services for running X11 (including the 3D window manager Compiz, KDE and parts of Gnome), Apache, PostgreSQL and many more. NixOS is fairly unique among Linux distributions in that it allows nonroot users to install software, thanks in part to the purely functional approach, which enables some strong security guarantees (Dolstra 2005, Section 3).…”