4 ms·

> A build is reproducible if given the same source code, build environment and build instructions It is very strange definition. To me it is tautological, as c

> A build is reproducible if given the same source code, build environment and build instructions It is very strange definition. To me it is tautological, as computers are deterministic and if you have same build environment you will get same results by necessity. Same bits into input - some bits out of output. Edit: formatting.

Foxboron 2y ago
> as computers are deterministic I have some bad news.
tazjin 2y ago
You're either assuming that "build environment" includes more things than the author does (it's not exactly a well-defined term), or you're not aware of the sources of non-reproducibility. It can be simple things (something includes timestamps in binaries, which can be worked around by pinning the time), and complex things (concurrent linking of binaries is done FIFO-style, and different compilation units finish at different times in different runs because of varying processor load).
- blacklion 2y ago
  assuming that "build environment" includes more things than the author does (*it's* *not* *exactly* *a* *well-defined* *term*) It is exactly my point. What is "build environment"? This definition is crucial for defining "reproducible builds" and we cannot handwave it away.
  - viraptor 2y ago
    Normally the built environment means the software part - files on the disk which are part of the build process. Your hardware, network, time, location, language, etc. shouldn't influence the output. There's an explanation at https://reproducible-builds.org/docs/definition/ https://reproducible-builds.org/docs/definition/ which is a bit vague, but I haven't heard anyone seriously disputing that one in good faith. People doing the work know what this means.
rnhmjoj 2y ago
> It is very strange definition. To me it is tautological, as computers are deterministic and if you have same build environment you will get same results by necessity. There is a lot of randomness in a typical build system: randomly ordered lists, race conditions in multithreaded coded, timestamps in the filesystem, etc, The worse kind of build systems can even include fetching files the internet. So, no, for all practical purposes actual computers are not deterministic and this is not tautological at all. You can try to emulate determinism using some kind of virtual machine and run your build there (for example, see Hermit[1]), but it will never be perfect determinism and there are many practical downsides. [1]: https://github.com/facebookexperimental/hermit https://github.com/facebookexperimental/hermit
- blacklion 2y ago
  Randomly ordered lists (and randomized hashmaps) typically relay on PRNG. Seed of PRNG is part of environment. If you use hardware RNG, it is part of environment and should be "the same". Same with timestamps. If you download files from Internet, whole Internet is your environment (and by pre-condition it must be "the same"). Of course, it is unrealistic. So... My point is: without very precise definition of "same build environment" all discussion of reproducible builds are almost meaningless.
  - viraptor 2y ago
    > all discussion of reproducible builds are almost meaningless. I see people working on reproducible builds understanding exactly what they work on and having successful conference talks. I understand their goal too. It could be less vague in the explanation on the website, but... There's a common understanding you seem to be missing, but that doesn't make the discussions/work meaningless.
  - magicalhippo 2y ago
    Keep in mind the list may be random or non-deterministic because no explicit order was imposed, and the source of the data is non-deterministic. For example listing files in a directory and adding them to a list for further processing, without explicitly sorting by some stable criteria like filename.

Foxboron 2y ago

> as computers are deterministic I have some bad news.

tazjin 2y ago

You're either assuming that "build environment" includes more things than the author does (it's not exactly a well-defined term), or you're not aware of the sources of non-reproducibility. It can be simple things (something includes timestamps in binaries, which can be worked around by pinning the time), and complex things (concurrent linking of binaries is done FIFO-style, and different compilation units finish at different times in different runs because of varying processor load).

blacklion 2y ago
assuming that "build environment" includes more things than the author does (*it's* *not* *exactly* *a* *well-defined* *term*) It is exactly my point. What is "build environment"? This definition is crucial for defining "reproducible builds" and we cannot handwave it away.
- viraptor 2y ago
  Normally the built environment means the software part - files on the disk which are part of the build process. Your hardware, network, time, location, language, etc. shouldn't influence the output. There's an explanation at https://reproducible-builds.org/docs/definition/ https://reproducible-builds.org/docs/definition/ which is a bit vague, but I haven't heard anyone seriously disputing that one in good faith. People doing the work know what this means.

rnhmjoj 2y ago

> It is very strange definition. To me it is tautological, as computers are deterministic and if you have same build environment you will get same results by necessity. There is a lot of randomness in a typical build system: randomly ordered lists, race conditions in multithreaded coded, timestamps in the filesystem, etc, The worse kind of build systems can even include fetching files the internet. So, no, for all practical purposes actual computers are not deterministic and this is not tautological at all. You can try to emulate determinism using some kind of virtual machine and run your build there (for example, see Hermit[1]), but it will never be perfect determinism and there are many practical downsides. [1]: https://github.com/facebookexperimental/hermit https://github.com/facebookexperimental/hermit

blacklion 2y ago
Randomly ordered lists (and randomized hashmaps) typically relay on PRNG. Seed of PRNG is part of environment. If you use hardware RNG, it is part of environment and should be "the same". Same with timestamps. If you download files from Internet, whole Internet is your environment (and by pre-condition it must be "the same"). Of course, it is unrealistic. So... My point is: without very precise definition of "same build environment" all discussion of reproducible builds are almost meaningless.
- viraptor 2y ago
  > all discussion of reproducible builds are almost meaningless. I see people working on reproducible builds understanding exactly what they work on and having successful conference talks. I understand their goal too. It could be less vague in the explanation on the website, but... There's a common understanding you seem to be missing, but that doesn't make the discussions/work meaningless.
- magicalhippo 2y ago
  Keep in mind the list may be random or non-deterministic because no explicit order was imposed, and the source of the data is non-deterministic. For example listing files in a directory and adding them to a list for further processing, without explicitly sorting by some stable criteria like filename.