4 ms·
Isn't this only a concern for OSS projects where reproducibility is a concern? At my proprietary coding job, reproducibility is a nonstarter anyway and build ti
by Steltek 5y ago
Isn't this only a concern for OSS projects where reproducibility is a concern? At my proprietary coding job, reproducibility is a nonstarter anyway and build time is super important for debugging day-to-day (or even minute to minute) problems.
- er4hn 5y agoIt's a concern for private industry as well. The solarwinds and other recent supply chain attack involved injecting additional code into a build environment. Reproducible builds could have been done in multiple places as an auditing mechanism to catch this. Another place where reproducible builds is useful in industry is being able to reproduce debug symbols for something after it has shipped. Sure you can rely on always saving debug symbols in an artifact repo, but if those age out and you get a customer case... what ya gonna do?