21–30 of 72 posts
Is Docker (or any other container platform) a facilitator to reproducible builds? Making the environment standard between builds is probably easier in a container.
The problem is if code includes the current date, or generates some randomness at build time. These issues must be identified and patched.
Earlier quoted context omitted.
Debian seems to only considers a build reproducible if the entire .deb file is byte-for-byte identical, not just the ELF files. A bunch of the packages they're tracking are flagged for documentation files such as PDFs not coming out identical.
Lots of dates and build numbers, hashes and more get put in binaries let alone package files. How could they ever be b4b the same?
Maybe im missing something but it seems the justification behind this is based on a situation in which source wasnt open. Debian is open so why is reproducibility a priority?
Is Docker (or any other container platform) a facilitator to reproducible builds? Making the environment standard between builds is probably easier in a container.
Is Docker (or any other container platform) a facilitator to reproducible builds? Making the environment standard between builds is probably easier in a container.
I'm not sure how the reproducible builds machines works for forcing two different build results, but i'd bet they're using sbuild too.
Here's a diffoscope of one of my packages which is not reproducible right now[2].
I also highly recommend the reproducible builds talk at this year's debconf with the repro build folks[3].
[1]https://wiki.debian.org/sbuild
[2]https://tests.reproducible-builds.org/debian/rb-pkg/unstable...
Earlier quoted context omitted.
Debian seems to only considers a build reproducible if the entire .deb file is byte-for-byte identical, not just the ELF files. A bunch of the packages they're tracking are flagged for documentation files such as PDFs not coming out identical.
Lots of dates and build numbers, hashes and more get put in binaries let alone package files. How could they ever be b4b the same?
I'm sure there are many, many more techniques involved in making a build reproducible. Hey, they achieved >90% already!
The lack of a .yet TLD is a real missed opportunity.
Maybe im missing something but it seems the justification behind this is based on a situation in which source wasnt open. Debian is open so why is reproducibility a priority?
Maybe im missing something but it seems the justification behind this is based on a situation in which source wasnt open. Debian is open so why is reproducibility a priority?
[0]https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binarie...
The lack of a .yet TLD is a real missed opportunity.
Meh, joke sites like this aren't nearly as prominent as sites for apps, I'd really like a .app TLD instead. That said, the distinction between app and service is blurring a lot, so Spotify and VS Code probably both qualify for .app but one also has a web interface. Everything is confusing, let's just stick to .com
And just because you are easily confused, everybody should stick to .com only?