On Wed, 2026-01-14 at 14:44 +0800, [email protected] wrote: > From: Changqing Li <[email protected]> > > Go packages and binaries are stamped with build IDs that record both the > action ID, which is a hash of the inputs to the action that produced the > packages or binary, and the content ID, which is a hash of the action > output, namely the archive or binary itself, Refer [1]. > > And action ID include hash of modroot, which will include build path, > so this make go package not reproducible. > Refer [2], keying off module path instead of module root directory is a TODO. > > [snip of log] > HASH[moduleIndex]: "go1.25.3" > HASH[moduleIndex]: "modroot > /build-a/tmp/work/x86-64-v3-wrs-linux/buildah/1.41.5/recipe-sysroot-native/usr/lib/go/src/cmd\n" > HASH[moduleIndex]: "package go1.25.3 go index v2 > /build-a/tmp/work/x86-64-v3-wrs-linux/buildah/1.41.5/recipe-sysroot-native/usr/lib/go/src/cmd/buildid\n" > HASH[moduleIndex]: "file buildid.go 2025-10-13 16:08:43 +0000 UTC 1704\n" > HASH[moduleIndex]: "file doc.go 2025-10-13 16:08:43 +0000 UTC 558\n" > HASH[moduleIndex]: > 007b9fe2edd5b3232f5c98ae6c46e80a435141cb627ba5418c5314c0cbf4df7b > > Report this issue to upstream, refer [3] > Workaround the reproducible by setting buildid to empty, refer [4]
The trouble is there is a lot of potentially important information going into these buildids and you're just removing that functionality entirely. Can we patch out the problematic component until it is fixed instead? I'm very reticent to remove them entirely, that doesn't feel like a good solution. Cheers, Richard
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#229323): https://lists.openembedded.org/g/openembedded-core/message/229323 Mute This Topic: https://lists.openembedded.org/mt/117257536/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
