3 ms·
If the build time is being included in the binary by default, I guess that means builds are not reproducible by default? Is there any easy way to exclude or str
by smaddox 5y ago
If the build time is being included in the binary by default, I guess that means builds are not reproducible by default? Is there any easy way to exclude or strip the build time to get a reproducible binary?
- cpuguy83 5y agoThey are already not reproducible. But build time is not included, it's the commit time of the commit the build comes from, from what I gather.
- neild 5y agoGo builds are, in general, reproducible by default. Build stamps do not change this.
- cpuguy83 5y ago"reproducible by default" if the system is setup a certain way. Build time injected into builds would absolutely break any reproducibility.
- neild 5y agoIt would, which is why the Go compiler and linker do not put the build time in binaries.
- cpuguy83 5y agoBut you literally said "build stamps do not change this", and it absolutely does. Of course as I mentioned it does not look like go is adding a build time to the binary.
- thiht 5y ago> "reproducible by default" if the system is setup a certain way What do you mean? Under what circumstances is a Go build not reproducible? From what I’ve observed, if you build your binary with a set of input, the same binary is produced. Is it sometimes not true?
- cpuguy83 5y agoBy default you need the same GOPATH and GOROOT. Compiler version must be identical (not a huge stretch). cgo reproducibility is not a guarantee.