3 ms·

oh yes, sorry, yes I'm that old. before linux, except for maybe gcc, open source was largely distributed as source. and I agree that installing linux as a bina

oh yes, sorry, yes I'm that old. before linux, except for maybe gcc, open source was largely distributed as source. and I agree that installing linux as a binary makes sense. but people didn't think it was important to maintain the reference back to the actual source used. I think to some extent (RedHat specifically), the patch sets used and the hidden build process was used to make it less trivial to reproduce.

uep 8y ago
The distros do maintain a reference back to the source. Debian makes it trivial to download the source code for packages and to build it yourself. apt source htop apt build-dep htop cd htop-2.0.2 dpkg-buildpackage -us -uc -nc
- uep 8y ago
  I should mention that reproducible builds are really about making bit-for-bit identical builds. There are reasons this is difficult, including individual projects inserting timestamps at the time that they build, or compile-time randomness, sort order of files in the filesystem based on the current locale, etc.
rstuart4133 8y ago
> less trivial to reproduce. Seriously, this is nit picking, and you seem to acknowledge that here by using the term "less trivial". Instead of "tar -x" you run "rpmbuild -bp" to get the patched source RedHat will unleash the compiler on. For debian its "dpkg-source -x". I'm not even sure that it could be called "less trivial". Getting hold of the source in the first place it looks to be "more trivial" to me as there is no Wumpus hunt to find the URL. For Debian it's just "apt-get source package-name". The RedHat equivalent is "yumdownloader --source". In both cases that gets you the exact source used to build the binary on your machine. I don't know what you would call a strong reference back to the actual source used, but I'm struggling to see how it could be much stronger. As for the "hidden build process": it's only hidden because it's automated. You may as well be blaming "make" for hiding the kernel build process, which is more complex than most distro package builds. But every step the distro build processes (any distro) can be made very visible, naturally enough because otherwise it would be impossible to debug when things go wrong. And there is excellent doco on how to do all of this for both Red Hat and Debian.

uep 8y ago

The distros do maintain a reference back to the source. Debian makes it trivial to download the source code for packages and to build it yourself. apt source htop apt build-dep htop cd htop-2.0.2 dpkg-buildpackage -us -uc -nc

uep 8y ago
I should mention that reproducible builds are really about making bit-for-bit identical builds. There are reasons this is difficult, including individual projects inserting timestamps at the time that they build, or compile-time randomness, sort order of files in the filesystem based on the current locale, etc.

rstuart4133 8y ago

> less trivial to reproduce. Seriously, this is nit picking, and you seem to acknowledge that here by using the term "less trivial". Instead of "tar -x" you run "rpmbuild -bp" to get the patched source RedHat will unleash the compiler on. For debian its "dpkg-source -x". I'm not even sure that it could be called "less trivial". Getting hold of the source in the first place it looks to be "more trivial" to me as there is no Wumpus hunt to find the URL. For Debian it's just "apt-get source package-name". The RedHat equivalent is "yumdownloader --source". In both cases that gets you the exact source used to build the binary on your machine. I don't know what you would call a strong reference back to the actual source used, but I'm struggling to see how it could be much stronger. As for the "hidden build process": it's only hidden because it's automated. You may as well be blaming "make" for hiding the kernel build process, which is more complex than most distro package builds. But every step the distro build processes (any distro) can be made very visible, naturally enough because otherwise it would be impossible to debug when things go wrong. And there is excellent doco on how to do all of this for both Red Hat and Debian.