HI Alex, I would like to go even further: Having any form of reproducibility actually isn’t a required attribute of any Apache releases (TLP or Podling).
I do think that in the future there will be more strict requirements, however currently we don’t have any such rules. Chris Von: PJ Fanning <fannin...@gmail.com> Datum: Dienstag, 23. Januar 2024 um 15:50 An: general@incubator.apache.org <general@incubator.apache.org> Betreff: Re: [QUESTION] Reproducible build for container images Hi Alex, While reproducible builds are a great idea, the Incubator PMC does not require them. Plugging away at improving things so that reproducible builds can be produced in future is a useful thing to do. Regards, PJ On Tue, 23 Jan 2024 at 14:58, Alex Porcelli <porce...@apache.org> wrote: > > In the KIE podling, we regularly publish container images as part of > our releases. We've achieved semantically identical images, verified > using the 'diffoci' tool. However, due to current Docker/OCI engine > limitations, we can't eliminate variations in file metadata caused by > automatically appended timestamps. > > The latest version of Buildkit offers a solution but still needs to be > integrated into the build engines. I want to ask the Incubator PMC: Is > achieving semantically verifiable images sufficient for now, as we > await the integration of Buildkit changes into Docker/OCI build > engines? > > Regards, > - > Alex > Apache KIE PPMC > > --------------------------------------------------------------------- > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > For additional commands, e-mail: general-h...@incubator.apache.org > --------------------------------------------------------------------- To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
