4 ms·
Changes in the build pipeline won’t be encoded in the git sha, since usually those are stored separately. And if you pull in a non-reproducible library, time wi
by ashtonkem 5y ago
Changes in the build pipeline won’t be encoded in the git sha, since usually those are stored separately. And if you pull in a non-reproducible library, time will matter a lot.
This of course could be fixed with a Nix type system (or even Nix itself), where the inputs of everything are hashed. But that’s a much more radical change than what OP is doing.
- capableweb 5y ago> Changes in the build pipeline won’t be encoded in the git sha, since usually those are stored separately. Build pipelines should be versioned as well. Correlate the application sha with the pipeline sha and you have both sources. > And if you pull in a non-reproducible library, time will matter a lot. I'd argue that if your application is pulling in a non-reproducible library and using it, then your application won't be reproducible until you've made the libraries you're using also reproducible. Otherwise the entire idea falls apart.