3 ms·
esy tries hard to enable reproducible builds: - esy builds are happening in an isolated environment with only specified dependencies available - esy executes
by andreypopp 8y ago
esy tries hard to enable reproducible builds:
- esy builds are happening in an isolated environment with only specified dependencies available
- esy executes build processes under sandboxing (so builds can't write into arbitrary locations, we have some work to do here though)
- esy has feature which allows to rewrite binaries to remove prefix paths from them.
As for package signing+verification (assuming you are talking about source code) we do only integrity checks now for packages downloaded from npm and via opam.
EDIT: wording
- Foxboron 8y agoAnd how is the build env recorded for timestamps and env variables? Is all of this standardized? >we do only integrity checks now for packages downloaded from npm and via opam Which is fine, but esy should be capable of accepting signatures and checking them against a given key.
- andreypopp 8y ago> And how is the build env recorded for timestamps and env variables? Is all of this standardized? We do record the build env now in esy's own format, you run: esy build-plan PKG to see the build plan (a-la Nix derivation) which is a JSON with build commands and environment. As regarding timestamps we don't set SOURCE_DATE_EPOCH yet but we definitely plan to address that.