3 ms·
"The xz incident became a wake-up call that the Reproducible Build movement focused on binary reproducibility, but have so far ignored tarball reproducibility."
by weinzierl 3y ago
"The xz incident became a wake-up call that the Reproducible Build movement focused on binary reproducibility, but have so far ignored tarball reproducibility."
The reproducibility must stretch over all the outputs.
A related idea is the Hermetic Build", where the sameness of all the input is ensured, even including the build tools.
- yencabulator 3y agoIn this case, inputs, or more like the whole chain toward "real inputs". A project can be reproducible when built from the release tarball, without being able to reproduce the release tarball from a git tag.