raboof

4 ms·

1. 1.▲
   by raboof 3y ago

   While I would love testing reproducibility more systematically, it would not really have helped for the Python 3.10 regression: in this case we knew full well that it would break reproducibility even before we merged the change, but the per
2. 2.▲
   by raboof 3y ago

   It indeed helps, but it is not a full 'solution': you could still in theory envision elaborate backdoors in the 'environment' in which the ISO is built. If you really want to 'solve' the problem describe ther
3. 3.▲
   by raboof 3y ago

   Not really: With input-addressing you look things up in the store based on the input hash. You can determine the input hash yourself, but you have to trust the store to provide a response that corresponds to the sources. With Reproducible B
4. 4.▲
   by raboof 3y ago

   The source for the cpython build is the release tarball ( https://github.com/NixOS/nixpkgs/blob/master/pkgs/developmen... ). In that case, NixOS sets SOURCE_DATE_EPOCH (which I suspect will be picked
5. 5.▲
   by raboof 3y ago

   For NixOS, it's in the 'how did we reproduce' section of the article: the last step of that process produces the iso in the ./result/iso directory. It sounds like what you're looking for is the commands that th