3 ms·

And how is the build env recorded for timestamps and env variables? Is all of this standardized? >we do only integrity checks now for packages downloaded from

And how is the build env recorded for timestamps and env variables? Is all of this standardized? >we do only integrity checks now for packages downloaded from npm and via opam Which is fine, but esy should be capable of accepting signatures and checking them against a given key.

andreypopp 8y ago
> And how is the build env recorded for timestamps and env variables? Is all of this standardized? We do record the build env now in esy's own format, you run: esy build-plan PKG to see the build plan (a-la Nix derivation) which is a JSON with build commands and environment. As regarding timestamps we don't set SOURCE_DATE_EPOCH yet but we definitely plan to address that.