RPM Community Forums

Mailing List Message of <rpm-devel>

Re: Mandatory/enforcing checks for "reproducible builds"

From: Anders F Björklund <afb@rpm5.org>
Date: Sun 28 Sep 2008 - 23:12:37 CEST
Message-Id: <AF4C692C-4B6A-4311-A7DF-3758B755C407@rpm5.org>
Jeff Johnson wrote:

> There are two big lies with rpm packaging methodolgy.
> (aside) The other lie is that rpm install transactions are
> atomic iff there are no packaging flaws or install host failures.
> But this lie is "reproducible builds", which is true wrto rpmbuild  
> iff the build
> host is set up (including configuration) equivalently/identically.

The attempts I've seen either include carefully documented build OS
setup instructions and then mean auditing with cattle prod handy*,
or scripting the whole thing up from scratch in an empty chroot -
which usually also helps with getting build dependencies right...

* In Mac land this usually translates to "Asking Happy Questions",
like  "did you install developer tools ?" "is your /usr/local empty ?"
"have you updated the port and every last dependency to the latest ?"
Which after a while makes even waiting for mach and mock seem like fun.

Received on Sun Sep 28 23:12:35 2008
Driven by Jeff Johnson and the RPM project team.
Hosted by OpenPKG and Ralf S. Engelschall.
Powered by FreeBSD and OpenPKG.