4 ms·

I'm having a hard time figuring out if esy supports reproducable builds, and package signing+verfication. And if reproducable builds are supported, what format

• andreypopp 8y ago
  esy tries hard to enable reproducible builds: - esy builds are happening in an isolated environment with only specified dependencies available - esy executes build processes under sandboxing (so builds can't write into arbitrary locations, we have some work to do here though) - esy has feature which allows to rewrite binaries to remove prefix paths from them. As for package signing+verification (assuming you are talking about source code) we do only integrity checks now for packages downloaded from npm and via opam. EDIT: wording
  • Foxboron 8y ago
    And how is the build env recorded for timestamps and env variables? Is all of this standardized? >we do only integrity checks now for packages downloaded from npm and via opam Which is fine, but esy should be capable of accepting signatures and checking them against a given key.
    • andreypopp 8y ago
      > And how is the build env recorded for timestamps and env variables? Is all of this standardized? We do record the build env now in esy's own format, you run: esy build-plan PKG to see the build plan (a-la Nix derivation) which is a JSON with build commands and environment. As regarding timestamps we don't set SOURCE_DATE_EPOCH yet but we definitely plan to address that.