4 ms·

Completely agree! The article is blinkered to the security aspect. But imagine if compilers didn't create reproducible builds. Debugging would be a nightmare!

renox 6y ago
Uh? Is that sarcasm? Compilers don't produce reproducible builds. If you try to investigate a core dump using a binary recompiled from sources instead of the original binary, it's very likely you won't be able to analyze the core..
- TwoBit 6y ago
  Since when don't compilers produce reproducible builds? We did that at my last workplace with appropriate MSVC compiler options. In any case, maybe parent is referring to using centralized debug symbols which can work for anybody in the org because their compilers all generate the same output.
- nix23 6y ago
  >it's very likely you won't be able to analyze the core.. You know that's the reproducible part, exact same library's same compiler same options. >Compilers don't produce reproducible builds. Sure they do, just compile two times the same and compare its hash, would be terrible if compilers makes something else every-time.
  - giantrobot 6y ago
    By default you're not guaranteed the exact same output in two compiled binaries. There's a lot of variable bits[1] that make into binaries from C and C++. Different languages/compilers have different levels of variable bits. [1] https://blog.conan.io/2019/09/02/Deterministic-builds-with-C-C++.html https://blog.conan.io/2019/09/02/Deterministic-builds-with-C...
    - nix23 6y ago
      >Different languages/compilers have different levels of variable bits. No that's the point! Exact same environment same binary, that's reproducibility.
      - giantrobot 6y ago
        Yes that would be reproducibility iff the environment is identical. However "identical environment" is a complicated issue. Differing file paths, timestamps, and host date/time can all easily make their way into a binary through macros in several languages without explicit compiler/linker flags. If compiled artifacts are bundled into a container (like a jar file) their metadata need to deterministically set or else the container as an artifact won't be deterministic. So yes doing all the work to make build deterministic enables reproducibility but it's not free or automatic. Then doing the work to ensure the build environment is deterministic is an additional task that's not free or automatic.
        nix23 6y ago
        >make build deterministic enables reproducibility but it's not free or automatic No one said that, Debian had a really hard time: https://wiki.debian.org/ReproducibleBuilds/About https://wiki.debian.org/ReproducibleBuilds/About

renox 6y ago

Uh? Is that sarcasm? Compilers don't produce reproducible builds. If you try to investigate a core dump using a binary recompiled from sources instead of the original binary, it's very likely you won't be able to analyze the core..

TwoBit 6y ago
Since when don't compilers produce reproducible builds? We did that at my last workplace with appropriate MSVC compiler options. In any case, maybe parent is referring to using centralized debug symbols which can work for anybody in the org because their compilers all generate the same output.
nix23 6y ago
>it's very likely you won't be able to analyze the core.. You know that's the reproducible part, exact same library's same compiler same options. >Compilers don't produce reproducible builds. Sure they do, just compile two times the same and compare its hash, would be terrible if compilers makes something else every-time.
- giantrobot 6y ago
  By default you're not guaranteed the exact same output in two compiled binaries. There's a lot of variable bits[1] that make into binaries from C and C++. Different languages/compilers have different levels of variable bits. [1] https://blog.conan.io/2019/09/02/Deterministic-builds-with-C-C++.html https://blog.conan.io/2019/09/02/Deterministic-builds-with-C...
  - nix23 6y ago
    >Different languages/compilers have different levels of variable bits. No that's the point! Exact same environment same binary, that's reproducibility.
    - giantrobot 6y ago
      Yes that would be reproducibility iff the environment is identical. However "identical environment" is a complicated issue. Differing file paths, timestamps, and host date/time can all easily make their way into a binary through macros in several languages without explicit compiler/linker flags. If compiled artifacts are bundled into a container (like a jar file) their metadata need to deterministically set or else the container as an artifact won't be deterministic. So yes doing all the work to make build deterministic enables reproducibility but it's not free or automatic. Then doing the work to ensure the build environment is deterministic is an additional task that's not free or automatic.
      - nix23 6y ago
        >make build deterministic enables reproducibility but it's not free or automatic No one said that, Debian had a really hard time: https://wiki.debian.org/ReproducibleBuilds/About https://wiki.debian.org/ReproducibleBuilds/About