2 ms·

The website being discussed in this thread is about the reproducibility of the crates (or other packages) themselves.

• TheDong 4y ago
  No, it's not about the reproducibility of crates or language-package-manager-packages, it's only about the reproducibility of packages in specific linux distributions. Those linux distributions often include their own custom build scripts and patches to make things reproducible. Debian isn't just execing "npm install" or "cargo install" when you "apt install <package>", so "reproducibility" in the context of this webpage doesn't necessarily mean anything at all about specific crates/packages, other than that the debian/arch/opensuse maintainers were able to make their build process for that package, possibly with patches, reproducible.
  • pabs3 4y ago
    Right now there are indeed zero people working on the reproducibility of crates and other language-package-manager packages, but there is no reason why the site would be restricted to distro packages once the language-package-manager communities start working on the reproducibility of their packages. Some distros actually do run `cargo install` or similar during build, although Debian does not indeed.
• Liquid_Fire 4y ago
  It doesn't make a difference, even if you look at that particular crate itself. Every time you build version X of that crate, you will build the same Rust code. Cargo actually gets this part right. (Of course it doesn't mean building the same Rust code gives you the same binary every time - that's a separate problem) Sure, _updating_ the crate might be a nightmare if the generation part is not stable - but that's unrelated to reproducibility.