On Fri, Nov 11, 2022 at 12:05:03PM +0100, Alexander Sosedkin wrote: > On Fri, Nov 11, 2022 at 11:53 AM Petr Pisar <ppisar@xxxxxxxxxx> wrote: > > > As a result, more RPM packages will be reproducible: > > > > Where will this reproducibility stop? > > Ideally, when it's achieved, > and 100% of Fedora will be reproducible under reprotest =P Exactly ;) My personal goal is to achieve 100% build reproducibility for packages and other build artifacts. This Change is just one of the first steps. Sources of non-reproducibility will be tackled one-by-one as we find them. > > An RPM package itself carry a build time in its RPM header. > > Are we also going to fake this time in the name of > > reproducibility? > > My opinion: yes, please do (%use_source_date_epoch_as_buildtime). Oh, I'm surprised we don't do this yet. I think we should. > And fake the builder hostname (%_buildhost). Yes. Maybe the best option is to set it when rebuilding an rpm to the original value. > And enable back --enable-deterministic-archives in binutils: > (https://bugzilla.redhat.com/show_bug.cgi?id=1195883). > And do whatever else is necessary to stop shipping binary packages > that users can't reproduce bit-to-bit. The compile-time setting is a brute hammer that affects too many things. Instead we should clamp the times inteligently where this makes sense. https://reproducible-builds.org/docs/archives/ describes the approaches that Debian took. E.g. for tar they add a --clamp-mtime flag, which seems a nicer approach. I think we'll want something similar for 'ar'. Zbyszek _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
