Yes, when you turn it up to 11, reproducible builds can be seen as a recursive problem. However, that's not a doom and gloom issue: like the old saying goes: H

Yes, when you turn it up to 11, reproducible builds can be seen as a recursive problem. However, that's not a doom and gloom issue: like the old saying goes: How do we eat an elephant? One bite at a time. The saying still works even if it's a recursive stack of elephants: just keep going one bite at a time. Repeatr formulas are a precise identification of one build. That doesn't mean you shouldn't make a build that's even more portable. It means you can use more than one formula to precisely describe, and test, how portable and flexible your build is. You can also use one formula to describe one step of a build (say, compiling a base image), and then output the resulting filesystem... it's assigned a hash, and you can use this as an input to another formula. Thus, you can use binary images, AND have a complete (recursive!) reproducibility path. You can use reppl [1] for creating pipelines like this (though it's not yet geared for public re-sharing and comparing of results -- that's a big todo, if you want to lend a hand!). > trusting trust is a hard problem. Imagine you had two formulas, both with fully hash-pinned input filesystems, which both build GCC. One uses a GCC binary as an input. The other uses a clang binary as an input instead. When you run each of them, you get a hash of the result filesystem. The remaining step to address Trusting Trust is left as an exercise to the reader :) --- [1] https://github.com/polydawn/reppl/ https://github.com/polydawn/reppl/