3 ms·
My hope is that a lot of the difficulty in getting reproducible builds is caused by outdated libraries and techniques. For example, assuming that your code is i
by armchairhacker 4y ago
My hope is that a lot of the difficulty in getting reproducible builds is caused by outdated libraries and techniques. For example, assuming that your code is in /usr/bin or /usr/lib, so any package manager has to emulate that.
My hope is that eventually, you can just run `cargo build --reproducible` or `meson build --reproducible` or `make --reproducible`, and if your architecture is the same, the dependencies will be the same and the output will run exactly the same. Even going as far as to install an older cargo or meson or CMake if that's what's needed for backwards compatibility. And if you want to be safe, you can create a sandbox or "jail" and libraries will know how to deal with it instead of just crashing when they try to access something outside.
- 3836293648 4y agocargo build --locked There is a lockfile, even if it's not respected by default. Doesn't help with build.rs being able to do whatever it wants but it's better than default
- IshKebab 4y agoI don't think that will ever really work reliably for something like cargo or meson. They don't really go to any effort to ensure clean build environments, enforce dependencies, sandbox builds etc. You need something like Bazel for that really.