Viewing profile — raboof

While I would love testing reproducibility more systematically, it would not really have helped for the Python 3.10 regression: in this case we knew full well that it would break r…

It indeed helps, but it is not a full 'solution': you could still in theory envision elaborate backdoors in the 'environment' in which the ISO is built. If you really want to 'solv…

Not really: With input-addressing you look things up in the store based on the input hash. You can determine the input hash yourself, but you have to trust the store to provide a r…

The source for the cpython build is the release tarball ( https://github.com/NixOS/nixpkgs/blob/master/pkgs/developmen... ). In that case, NixOS sets SOURCE_DATE_EPOCH (which I sus…

For NixOS, it's in the 'how did we reproduce' section of the article: the last step of that process produces the iso in the ./result/iso directory. It sounds like what you're looki…