5 ms·
Reproducible builds can have some unexpected benefits. For example, a package build machine could track compiled files that have changed since it compiled an ol
by anjbe 11y ago
Reproducible builds can have some unexpected benefits. For example, a package build machine could track compiled files that have changed since it compiled an older version of the software, and store them at the start of the archive when zipping the installable files into package. Then when the user’s package manager updates to the newer package, it only has to download enough of it to extract all the files that have changed between versions, thus saving time and bandwidth. Software that builds reproducibly will have fewer gratuitous changes (dates, etc), thus making this process work better.
In fact, OpenBSD’s and PC-BSD’s package managers do this. It’s briefly touched on in the last slide of this talk: http://www.openbsd.org/papers/eurobsdcon2015-packages.pdf http://www.openbsd.org/papers/eurobsdcon2015-packages.pdf
- lamby 11y agoMm. Reproducible builds have a really wide variety technical advantages, including implicitly removing non-deterministic or unsafe behaviour (such as downloading third-party code from the internet), detecting corrupted build environments, reducing time-to-detection of a build host compromise, validating cross-built packages, the potential space/time savings you mention as well as numerous other debugging and testing advantages. In other words, even if you are an attacker, you want reproducible builds. :)