On 10/31/16 12:41 AM, Jim Cheetham wrote: > Quoting john hood (2016-10-31 17:12:06) >> Alas, we will not get any kind of repeatable builds out of this, Travis >> constantly updates their build images and we update to current Homebrew >> for dependencies on every build. > > That's the worst bit. Using external services that are *unlikely* to attack > your process is generally just fine, as long as there is a way to verify their > output.
The repeatability is of course no worse than what we've got now :)
> Perhaps you could use Travis to report in the buildability of a revision,
> and the source of a 'nightly build' version, but keep a repeatable
> build chain for official releases?
We already use Travis for CI builds on Linux and OS X. I could of
course maintain a build VM for Mosh releases and snapshot it for each
release build, but having to maintain it (OS X upgrades, Xcode upgrades)
for Mosh's fairly infrequent releases is a significant burden for a
small project, and it would bring us full circle to manually-maintained
private builds.
We can at least report the Travis image id (I think this is already in
the build log) and the Homebrew version + Git revisions, and other tool
versions. Homebrew has a way to dump its configuration ('homebrew info
--json=v1') which may or may not be complete.
The elephant in the room is that we're trying to improve builds for a
binary-only, proprietary OS with relatively ad-hoc installation,
configuration, packaging, etc.
regards,
--jh
signature.asc
Description: OpenPGP digital signature
_______________________________________________ mosh-devel mailing list mosh-devel@mit.edu http://mailman.mit.edu/mailman/listinfo/mosh-devel
