3 ms·
Already adresse in the documentation in the form of "SOURCE_DATE_EPOCH". Adding these things to projects in general is terrible.
by Foxboron 8y ago
Already adresse in the documentation in the form of "SOURCE_DATE_EPOCH". Adding these things to projects in general is terrible.
- ChrisCinelli 8y agoSure there are ways to do it, but every piece of software needs to be aligned. What I was trying to say is that even if you have the tools you probably cannot "just use the tools". You will likely have to create patches for those piece of softwares that create a different artifact every time are built. There are a few other challenges but in my humble opinion, it is worthwhile to strive to write your own software with "reproducible builts" in mind so everybody can verify if something was altered.
- Foxboron 8y agoWe are well aware of the challenges. Read a bit into the documentation and the efforts that has gone into achieving reproducible builds on different distributions. This is hard on distributions as we are suppose to support all the ecosystems. But for rubygems, pypi, go, rust, npm and so on this is a easier problem to solve if they want to. But even with all these challenges, Debian is at 94% reproducible packages, and Arch is edging closer to 80%. Introducing non-determinism into your build process is something that should be removed, and all ecosystems should be aligned in this effort. Weekly blog posts are written about the current efforts. https://reproducible-builds.org/blog/ https://reproducible-builds.org/blog/
- ChrisCinelli 8y agoAgain, we are on the same page. 80% is what I was expecting. 94% is very good!