3 ms·
I've learned recently that even using Nix when building from source is something of a false hope of reproducibility. Many packages use the fetchgit function and
by KirinDave 9y ago
I've learned recently that even using Nix when building from source is something of a false hope of reproducibility. Many packages use the fetchgit function and fetchgit violates the contract.
- Filligree 9y agofetchgit does no such thing. To use it, you need to specify the git revision and the hash of the output; it's a constant-output derivation just like fetchurl. Reproducbility is still a difficult problem, but that isn't one of them, and Nix comes far closer than Gentoo.
- KirinDave 9y agohttps://twitter.com/shlevy/status/956313877800566784?ref_src=twcamp%5Ecopy%7Ctwsrc%5Eandroid%7Ctwgr%5Ecopy%7Ctwcon%5E7090%7Ctwterm%5E0 https://twitter.com/shlevy/status/956313877800566784?ref_src...
- mst 9y agoI do hope somebody either makes that start warning, then removes it, or at least adds it to a linter of some sort.