3 ms·
> ... what about files metadata like creation/modification timestamps? Do they forge them? The least difficult to solve for reproducible build but yes. The re
by TacticalCoder 2y ago
> ... what about files metadata like creation/modification timestamps? Do they forge them?
The least difficult to solve for reproducible build but yes.
The real question is: why, in the past, was an entire ecosystem created where non-determinism was the norm and everybody thought it was somehow ok?
Instead of asking: "how one achieves reproducibility?" we may wonder "why did people got out of their way to make sure something as simple as a timestamp would screw determinism?".
For that's the anti-security mindset we have to fight. And Debian did.
- BobbyTables2 2y agoYou’re forgetting that source control used to not be a mainstream practice… Software was more artisanal in nature…
- brohee 2y agoTBH security is someone the source of the issues, as it often involves adding randomness. For example, replacing deterministic hashes by keyed hashes to protect from hash flooding DoS led to deterministic output becoming nondeterministic (e.g. when displaying a hash table in its natural order). Sorting had to be added to that kind of output.