3 ms·
Yes - to clarify this further: as I understand it (and I'm not deeply familiar with the process), reproducible builds require that developers take additional me
by jka 7y ago
Yes - to clarify this further: as I understand it (and I'm not deeply familiar with the process), reproducible builds require that developers take additional measures to ensure that their source code cannot accidentally or intentionally produce variant build output.
That means that some commonly-used practices like embedding current timestamps into files become unacceptable.
It does tighten the development constraints -- although frankly, that's similar to many other secure coding practices. Better tooling, linting and frameworks will help to reduce the developer friction.
- m4rtink 7y agoYep, IIRC timestamps are one of the issues - you can either drop the.timestamp or inject a well documented timestamp from the outside, so the user can do that as weel during the rebuild. Indeed, a lot of the stuff you need to do to achieve reproducible builds can definitely make your build process more robust and secire.