GitHub user mengw15 added a comment to the discussion: Build reproducibility for automated release signing
Thanks! Rebuilt `7f627c0b2` with `SOURCE_DATE_EPOCH=1791491650` and `PACKAGE_SNAPSHOT=2026-10-08` (BuildKit v0.33.1, clean worktree, `--no-cache`, `linux/amd64`). `texera-workflow-execution-coordinator`, identical across two back-to-back builds: - config `300b138b765a` (`sha256:300b138b765a0fb5c453bb886e42a3e0ce428310615f376f745c2b614be87bcb`) - manifest `sha256:6b237b00e4a688d1e972296330c2df3112d258915dc94da2e2b5f1628da8d4a1` `y-websocket-server` doesn't reproduce even against itself: two back-to-back builds on my machine differ only in the `npm ci` layer, and only in caches written during the install: 543 files under `/tmp/node-compile-cache/` and 39 under `/root/.npm/` (cache index entries record a write time, and the debug log is named after the clock). `node_modules` is identical. With `RUN npm ci && rm -rf /root/.npm /tmp/node-compile-cache`, two builds come out identical (manifest `sha256:3a853e79…`). Its `FROM node:24.19.0-slim` isn't pinned to a digest yet either. GitHub link: https://github.com/apache/texera/discussions/8807#discussioncomment-18960342 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected]
