4 ms·

It all started with glib/compilers/LLVM/Windows toolkit not being able to reproduce a build, byte-for-byte.

• egberts1 4y ago
  As a QA can see, the inability to procure a reproducible executable checksum values allowed all sorts of non-validated (and un-validatable) things to creep into production.
• egberts1 4y ago
  Of course, timestamp is the biggest offender of recreatable (deterministic) build. https://blog.conan.io/2019/09/02/Deterministic-builds-with-C-C++.html https://blog.conan.io/2019/09/02/Deterministic-builds-with-C...
  • pabs3 4y ago
    Indeed, tons of other issues prevent deterministic builds though: https://reproducible-builds.org/docs/ https://reproducible-builds.org/docs/
• ciupicri 4y ago
  What difference does it make if the build is compromised in an identical way byte-for-byte?
  • acuozzo 4y ago
    https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
    • ciupicri 4y ago
      How will a trusty compiler going to save you from a broken library, e.g. the npm colors package?
      • acuozzo 4y ago
        The software supply chain problem exists for native code as well.
• pabs3 4y ago
  These folks are working on fixing that problem: https://reproducible-builds.org/ https://reproducible-builds.org/ https://bootstrappable.org/ https://bootstrappable.org/