2 ms·
But I would assume you would build it in your own hermetic build system and use those artifacts as the reproducible artifacts, since you don’t trust the precomp
by fnordpiglet 3y ago
But I would assume you would build it in your own hermetic build system and use those artifacts as the reproducible artifacts, since you don’t trust the precompiled distribution. Instead you would start your chain of trust with your build.
- monocasa 3y agoThe whole problem is that binaries are in the regular source distribution unfortunately with no way to turn off their usage.
- fnordpiglet 3y agoYes thanks as I read the issue and the code I realized the advice was to patch downstream. I know a lot of folks who build hermetic and reproducible builds for large amounts of open source code often have to patch downstream, but its fairly rare to see that requirement from such a basic crate/library. Hopefully this resolved at some point, it seems like a pretty aggressive stance to take that puts people who have a hard job (rigorous chain of trust in builds is hard work and done for very good reasons!!) in a harder spot.