4 ms·

They are definitely redefining "idempotent" here, even from a software development standpoint. Since we already have "deterministic build" and "reproducible bu

by jmull 2y ago

They are definitely redefining "idempotent" here, even from a software development standpoint. Since we already have "deterministic build" and "reproducible build" for this, there's no need to overload "idempotent" (which already causes confusion).

hinkley 2y ago
I assumed idempotent here was going to be about some trick of incremental compilation. Not reproducible builds.
kreetx 2y ago
Idempotent sounds confusing to me as an idempotent HTTP request (not very mathy, I know) I could run many times over, the effect being as if it were done once on the first time. For a software build it sounds like running `make` multiple times. But those builds will be idempotent even without reproducibility/determinism as they happen on the same system.
- NortySpock 2y ago
  But isn't that just deterministic behavior? "Multiple runs of the same compiler on the same code produced the same output" No more revolutionary a concept than a hash function. Valuable like a hash function, but not revolutionary.
  - jmull 2y ago
    Well, a second call to "make" with unmodified source on a local system has the same resulting output because make knows how to avoid rebuilding output files when the source hasn't changed since the last build. The goal of reproducible/deterministic builds is typically to be able to produce the same output files without already having that output. (That's because the people interested in reproducible/deterministic builds are usually trying to prove something about the relationship between the source and the build output. Make doesn't really do that -- the only thing it can prove is that the mod times of output files are later than the mod times of the source files they depend on, according to the make file.) So, yes, make is typically deterministic in a general sense (given a good makefile and certain assumptions that are pretty reasonable in the context of a developer doing development on a local machine). But isn't what people are looking for from reproducible/deterministic builds.
Animats 2y ago
Agree. "Reproducible" is the right term here. An idempotent build is when you type "make" twice and the second one doesn't do anything. This stuff matters. You can't trust open source supply chains any more. There have been too many incidents of someone inserting a security hole.

by jmull 2y ago

hinkley 2y ago

I assumed idempotent here was going to be about some trick of incremental compilation. Not reproducible builds.

kreetx 2y ago

Idempotent sounds confusing to me as an idempotent HTTP request (not very mathy, I know) I could run many times over, the effect being as if it were done once on the first time. For a software build it sounds like running `make` multiple times. But those builds will be idempotent even without reproducibility/determinism as they happen on the same system.

NortySpock 2y ago
But isn't that just deterministic behavior? "Multiple runs of the same compiler on the same code produced the same output" No more revolutionary a concept than a hash function. Valuable like a hash function, but not revolutionary.
- jmull 2y ago
  Well, a second call to "make" with unmodified source on a local system has the same resulting output because make knows how to avoid rebuilding output files when the source hasn't changed since the last build. The goal of reproducible/deterministic builds is typically to be able to produce the same output files without already having that output. (That's because the people interested in reproducible/deterministic builds are usually trying to prove something about the relationship between the source and the build output. Make doesn't really do that -- the only thing it can prove is that the mod times of output files are later than the mod times of the source files they depend on, according to the make file.) So, yes, make is typically deterministic in a general sense (given a good makefile and certain assumptions that are pretty reasonable in the context of a developer doing development on a local machine). But isn't what people are looking for from reproducible/deterministic builds.

Animats 2y ago

Agree. "Reproducible" is the right term here. An idempotent build is when you type "make" twice and the second one doesn't do anything. This stuff matters. You can't trust open source supply chains any more. There have been too many incidents of someone inserting a security hole.