Build versus Runtime Dependencies in Nix : <p>I am just starting to get to grips with Nix, so apologies if I missed the answer to my question in the docs.</p>

<p>I want to use Nix to setup a secure production machine with the minimal set of libraries and executables. I don't want any compilers or other build tools present because these can be security risks. </p>

<p>When I install some packages, it seems that they depend on only the minimum set of runtime dependencies. For example if I install <code>apache-tomcat-8.0.23</code> then I get a Java runtime (JRE) and the pre-built JAR files comprising Tomcat.</p>

<p>On the other hand, some packages seem to include a full build toolchain as dependencies. Taking another Java-based example, when I install <code>spark-1.4.0</code> Nix pulls down the Java development kit (JDK) which includes a compiler, and it also pulls the Maven build tool etc.</p>

<p>So, my questions are as follows:</p>

<ol>
<li>Do Nix packages make any distinction between build and runtime dependencies?</li>
<li>Why do some packages appear to depend on build tools whereas others only need runtime? Is this all down to how the package author wrapped up the application?</li>
<li>If a package contains build dependencies that I don't want, is there anything that I, as the operator, can do about it except design my own alternative packaging for the same application?</li>
</ol>

<p>Many thanks.</p>
