3 ms·
They are already not reproducible. But build time is not included, it's the commit time of the commit the build comes from, from what I gather.
by cpuguy83 5y ago
They are already not reproducible.
But build time is not included, it's the commit time of the commit the build comes from, from what I gather.
- neild 5y agoGo builds are, in general, reproducible by default. Build stamps do not change this.
- cpuguy83 5y ago"reproducible by default" if the system is setup a certain way. Build time injected into builds would absolutely break any reproducibility.
- neild 5y agoIt would, which is why the Go compiler and linker do not put the build time in binaries.
- cpuguy83 5y agoBut you literally said "build stamps do not change this", and it absolutely does. Of course as I mentioned it does not look like go is adding a build time to the binary.
- thiht 5y ago> "reproducible by default" if the system is setup a certain way What do you mean? Under what circumstances is a Go build not reproducible? From what I’ve observed, if you build your binary with a set of input, the same binary is produced. Is it sometimes not true?
- cpuguy83 5y agoBy default you need the same GOPATH and GOROOT. Compiler version must be identical (not a huge stretch). cgo reproducibility is not a guarantee.