Hacker News new | past | comments | ask | show | jobs | submit login

>Different languages/compilers have different levels of variable bits.

No that's the point! Exact same environment same binary, that's reproducibility.




Yes that would be reproducibility iff the environment is identical. However "identical environment" is a complicated issue.

Differing file paths, timestamps, and host date/time can all easily make their way into a binary through macros in several languages without explicit compiler/linker flags. If compiled artifacts are bundled into a container (like a jar file) their metadata need to deterministically set or else the container as an artifact won't be deterministic.

So yes doing all the work to make build deterministic enables reproducibility but it's not free or automatic. Then doing the work to ensure the build environment is deterministic is an additional task that's not free or automatic.


>make build deterministic enables reproducibility but it's not free or automatic

No one said that, Debian had a really hard time:

https://wiki.debian.org/ReproducibleBuilds/About




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: