4 ms·
Knowing the build was reproducible tells me nothing of value. Knowing the timestamp of when it was built, or the source was downloaded tells me roughly how old
by jlarocco 8y ago
Knowing the build was reproducible tells me nothing of value.
Knowing the timestamp of when it was built, or the source was downloaded tells me roughly how old the package is, which can be useful for a variety of reasons.
- detaro 8y agoDo you care when the build was made or from when the code build into it is? The former is a problem for reproducible builds, the latter is possible.
- anth_anm 8y agoI can do a build off of year old code. Would you rather you get a timestamp embedded that tells you it was built today, or take the hash and be able to find the exact revision.
- Foxboron 8y ago>Knowing the build was reproducible tells me nothing of value. It does. It proves that the given package was produced by the given source code. However, you can keep the timestamp as well! One of the goals of reproducible builds is to record values like this so it can be replayed later at a future point in time. This is done by the BUILDINFO format. https://reproducible-builds.org/docs/recording/ https://reproducible-builds.org/docs/recording/
- kpcyrd 8y agoYou don't care about the build date, you care about the release date, which is specifically what debian is trying to achieve with SOURCE_DATE_EPOCH.
- patrec 8y ago> Knowing the build was reproducible tells me nothing of value. It means you can uniquely address what you wanted by what you got (and vice versa). This makes storing and retrieving things much easier, scalable and secure. It also makes it much easier to ensure that you got what you wanted, and someone else did too, on their machine.