3 ms·

Is there a reason you can't just achieve deterministic builds using docker containers as your build environment (which have the appropriate sysroot, compilers,

by umvi 7y ago

Is there a reason you can't just achieve deterministic builds using docker containers as your build environment (which have the appropriate sysroot, compilers, dependencies, etc. inside)?

knorker 7y ago
Yes. Did you read about date, time, and actual calls to RNGs? And nondeterminism of listdir? I don't think you actually read the article.
- umvi 7y ago
  I did, but those seemed like obscure macros/corner cases almost no one uses. I was more arguing for use of Docker instead of "Conan" or whatever tool they were selling.
  - knorker 7y ago
    Docker won't help with the issues mentioned. I still don't believe you actually read it.
    - umvi 7y ago
      The article: "watch out for these super obscure corner cases that could impede you from making deterministic builds. Use our tool to mitigate them!" Me: "who cares about those corner cases, almost nobody would run into them. 99% of developers can achieve deterministic builds by standardizing compilers/dependencies inside of a docker image and using that to build the binaries."
      - knorker 7y ago
        I don't disagree that they seem to be pushing their tool for use cases that are not needed. Still, your "just do X" doesn't address the majority of the provided "sources of variation".
ryukafalz 7y ago
Containers can be used as part of a deterministic build process, but they're not a silver bullet on their own: >which have the appropriate ... dependencies What are your dependencies? Have you specified them precisely? Does anything in the build process use timestamps at any point? If so, your build isn't deterministic. Furthermore, if your goal is reproducible builds rather than simple determinism, you may then care about where e.g. the GCC binary in your Docker container came from.
patthebunny 7y ago
The entire toolchain is non-deterministic. People also do stuff to make it worse. For example the compiler backend is multi-threaded and spits out data in whatever order, doesn't matter normally because they designed it that way. But in a determinstic scenario you have to change that. Then you have to worry about timestamps in PE headers, macros in code, other tools messing with things, etc... Then you have the issues of wanting to cache, that's where things like pathing come in to play.

by umvi 7y ago

Is there a reason you can't just achieve deterministic builds using docker containers as your build environment (which have the appropriate sysroot, compilers, dependencies, etc. inside)?

knorker 7y ago

Yes. Did you read about date, time, and actual calls to RNGs? And nondeterminism of listdir? I don't think you actually read the article.

umvi 7y ago
I did, but those seemed like obscure macros/corner cases almost no one uses. I was more arguing for use of Docker instead of "Conan" or whatever tool they were selling.
- knorker 7y ago
  Docker won't help with the issues mentioned. I still don't believe you actually read it.
  - umvi 7y ago
    The article: "watch out for these super obscure corner cases that could impede you from making deterministic builds. Use our tool to mitigate them!" Me: "who cares about those corner cases, almost nobody would run into them. 99% of developers can achieve deterministic builds by standardizing compilers/dependencies inside of a docker image and using that to build the binaries."
    - knorker 7y ago
      I don't disagree that they seem to be pushing their tool for use cases that are not needed. Still, your "just do X" doesn't address the majority of the provided "sources of variation".

ryukafalz 7y ago

Containers can be used as part of a deterministic build process, but they're not a silver bullet on their own: >which have the appropriate ... dependencies What are your dependencies? Have you specified them precisely? Does anything in the build process use timestamps at any point? If so, your build isn't deterministic. Furthermore, if your goal is reproducible builds rather than simple determinism, you may then care about where e.g. the GCC binary in your Docker container came from.

patthebunny 7y ago

The entire toolchain is non-deterministic. People also do stuff to make it worse. For example the compiler backend is multi-threaded and spits out data in whatever order, doesn't matter normally because they designed it that way. But in a determinstic scenario you have to change that. Then you have to worry about timestamps in PE headers, macros in code, other tools messing with things, etc... Then you have the issues of wanting to cache, that's where things like pathing come in to play.