3 ms·
It seems that a proper reproducible build checker should omit this kind of metadata from the portions of an executable that it verifies to be the same.
by WJW 5y ago
It seems that a proper reproducible build checker should omit this kind of metadata from the portions of an executable that it verifies to be the same.
- verytrivial 5y agoProper does not mean an endless list of exceptions to deal with the endless number of ways to exclude effectively random, non-functionally relevant information in the binaries. Because that where reproducible builds started. Projects not interested in reproducibility can/should content themselves to live in the non-reproducible set instead of expecting someone else to monkey patch for them!
- smitop 5y agoIt's hard to statically determine what parts of an executable affect the running of it. Many executable have timestamps in them that do affect how they run, so you can't just ignore all timestamps if you want reproducible builds. See https://reproducible-builds.org/docs/timestamps/ https://reproducible-builds.org/docs/timestamps/
- akavel 5y agoWill 2 binaries differing by timestamp hash the same? do you suggest that file hashing algorithms skip date bytes in a binary? The KISS solution is to not vary date in the binary.
- capableweb 5y agoNot sure why the timestamp of when the build happened should even be logged. Include the git repository, the sha and if on CI, the build number/hash and you're pretty much covered.