Nimble lockfile and Nim compiler version interoperability for reproducible builds
0 reputation · 02 Feb 2021, 11:29 UTC
Goal: ensure that a Nimble lockfile captures the exact Nim compiler version used during dependency resolution so that rebuilding the project on any machine yields bit‑identical binaries.
Currently, Nimble writes package versions and source URLs to nimble.lock but omits the compiler version; the minNimVersion field in nimble.yml only specifies a minimum version, leaving patch‑level changes unrecorded and making builds potentially sensitive to compiler‑specific features or ABI shifts.
The Nim community debates whether extending the lockfile schema to include a compiler version hash would improve reproducibility at the cost of flexibility, and how such a change would affect existing projects that rely on the current lockfile format.
Should Nimble extend the lockfile to store an exact compiler version hash? What trade‑offs arise between guaranteed reproducibility and the ability to use newer, backward‑compatible compiler releases? How would a schema change impact existing lockfiles and downstream tooling?