3 ms·

This package recipe actually builds from source, which is great! I swear that at one point the mysql package downloaded a pre-built binary from a third party s

This package recipe actually builds from source, which is great! I swear that at one point the mysql package downloaded a pre-built binary from a third party site. Even with a cryptographic hash, I don't trust it, because it could have been built with a tainted compiler. This brings me to an issue that I have not only with homebrew, but with most other package managers: reproducibility. Can I have any confidence that the binaries built on your machine and my machine are the same?

tlrobinson 12y ago
It actually includes methods for both prebuilt binaries ("bottles" in homebrew terminology) and source. It will use a bottle if one exists for your OS version, but you can force installation from source with "--build-from-source". The problem of bitwise-identical / deterministic builds is difficult when using most legacy tooling, in particular tools that insert timestamps or other non-determinism. Bitcoin and Tor use Gitian https://gitian.org/ https://gitian.org/ and Google just open sourced their tool, Bazel http://bazel.io/ http://bazel.io/