3 ms·
Is git archive deterministic? I think github has trouble here. (No argument that is ought to be deterministic.)
by rwmj 3y ago
Is git archive deterministic? I think github has trouble here. (No argument that is ought to be deterministic.)
- lrvick 3y agoIn my experience, yes. Provided it is done with a known git binary etc. Best to containerize workflows like this with hash-locked deps so they can be easily verified by others even far in the future with any OCI compatible toolchain.
- hobofan 3y agoThe GitHub implementation of git archive does it's best to be deterministic. Some reproducible build systems like e.g. Bazel heavily rely on that. GitHub had a bug early last year[0] that broke that determinism and it caused a huge uproar. So through a mixture of promises to individual projects and just so many projects relying on it, GitHub's git archive has been ossified into being deterministic (unless they want to lose a lot of goodwill among developers). [0]: https://github.com/orgs/community/discussions/45830 https://github.com/orgs/community/discussions/45830