Re: Tracking source code: whatsrc.org

Hi! kpcyrd skribis: > I'm indeed very interested, I looked at it briefly and have two questions: > > 1) In the `sources` list, how do I figure out which package a source > object belongs to? Oh, I had overlooked that; short answer is: you can’t tell which package it corresponds to. But with

Re: Tracking source code: whatsrc.org

Hey kpcyrd, kpcyrd skribis: > This allows lookups like: > > https://whatsrc.org/artifact/sha256:981a75f8291020d9f6632c6160ee3651f376bdf354373bea00506a220e355134 Excellent! I find this very useful. If you’re interested, you can incorporate data from , a file

Rebuildling software years later

Hello, "Chris Lamb" skribis: > "Reproducibility of Build Environments through Space and Time" [11] by > Julien Malka, Stefano Zacchiroli and Théo Zimmermann (Institut > Polytechnique de Paris, France [12]) addresses: > >> [The] principle of reusability […] makes it harder to reproduce >>

Re: limits to verifiability

Hello, aho...@0w.se skribis: > The practicality of SSSBEA-CODRB means that the efforts aimed at > *minimizing the starting binary seed* and at creation of an > *inspectable-in-binary-form* seed like e.g. in GNU > Mes[11],[12] seem misdirected, such a seed is now known to be > unnecessary for a

Re: scheme and lisp

Hello Bernhard, "Bernhard M. Wiedemann via rb-general" skribis: > in openSUSE there are some packages that so far refuse to build > reproducibly. The common theme around them is that they use scheme or > lisp to produce binaries with a 'dump' command. I think this practice is vanishing. For

Re: Journal article in reproducible builds

Hi, Simon Butler via rb-general skribis: > I'm pleased to announce that Software Quality Journal have published a > article on reproducible builds. The article is open access and is at > https://link.springer.com/article/10.1007/s11219-022-09607-z Thanks for the well-documented and insightful

Re: Making reproducible builds & GitBOM work together in spite of low-level component variation

Hello, Vagrant Cascadian skribis: > I can see the value in embedding provenence information in the build > artifacts, but that makes reproducible builds considerably harder to > achieve if it is recording *everything* about the build environment. I think this raises an important question:

Re: GNU Mes 0.24 released

Heya, Jan Nieuwenhuizen skribis: > Mes has now been ported to M2-Planet and can be bootstrapped using > stage0-posix[0], starting from the 357-byte hex0 binary of the > bootstrap-seeds[1], as was promised at FOSDEM'21[2]. This is amazing… congrats to you & everyone involved! You made it! :-)

Re: Recoding the configuration for live-build images

Hi, John Gilmore skribis: > Does the GNU Mes bootstrap-reducing team have a plan to replace Grub and > the Linux kernel and init (and perhaps a BIOS?) with something tiny that > runs on bare metal and implements a file system, the mount command, and > processes? Many realtime OS's are much

Re: [PATCH] Explain how to contribute to reproducible builds in Guix.

Holger Levsen skribis: > On Wed, May 26, 2021 at 11:49:45AM +0200, Ludovic Courtès wrote: >> I thought it could be useful to have pointers to help out on reproducible >> builds in Guix, so here we go. Let me know what you think! > > yay! already commited by Arnout it seems!

[PATCH] Explain how to contribute to reproducible builds in Guix.

--- contribute/guix.md | 47 + contribute/index.md | 4 2 files changed, 51 insertions(+) create mode 100644 contribute/guix.md Hello! I thought it could be useful to have pointers to help out on reproducible builds in Guix, so here we go.

Re: Use SOURCE_DATE_EPOCH with GNU install

"Chris Lamb" skribis: > Ludovic Courtès wroteP > >> > │ - Birth: 2020-07-20 09:02:11.688603176 + >> > │ + Birth: 2020-07-20 08:47:51.046971751 + >> >> As you can see above, Nix resets the modification time (“mtime”) of >> installed fil

Re: Use SOURCE_DATE_EPOCH with GNU install

Hi David, David Kleuker skribis: > [davidak@nixos:~]$ diffoscope > /nix/store/cwmpm1kk3pfw1d5x5wfv691fw378gsjl-agave-16 > /nix/store/8p0bn5y6nlcrkclz4vz4rxjycs2imiwl-agave-16 > --- /nix/store/cwmpm1kk3pfw1d5x5wfv691fw378gsjl-agave-16 > +++ /nix/store/8p0bn5y6nlcrkclz4vz4rxjycs2imiwl-agave-16

Re: [rb-general] Quick reproducible test for GNU Guix

Hi Vagrant! Vagrant Cascadian skribis: > I did some quick reproducibility testing running GNU Guix, and so far > got pretty good results: > > Using guix (and packages) built from commit: > > f83d07f7778b699d46741a5667113342f5f0a737 > > $ guix challenge --verbose --diff=diffoscope ... > 2,463

[rb-general] GNU Guix report on the summit

Hello! Here’s a report from us Guix about the Reproducible Builds Summit: https://guix.gnu.org/blog/2019/reproducible-builds-summit-5th-edition/ As in previous years, it’s been a good moment in itself and also a great boost for our hacking projects. Thanks again to all the organizers and

Re: [rb-general] Addresses in (I)Python output

Hello, "Rebecca N. Palmer via rb-general" skribis: > In Python, objects that don't have an explicit string representation > have a default one that includes their memory address, which is very > likely to vary from run to run: > lambda x:x > at 0x7f80c9f937b8> Naive question: if you

Re: [rb-general] advice on stashing compiler options in a binary

Hello, "Chris Lamb" skribis: >> I recently realized this leads to a paradox with the -fdebug-prefix-map >> option, since the original build directory is recorded in the stashed >> compiler options. > > Indeed. I have so far failed to come up with any kind of cleaner > solution when fixing

Re: [rb-general] Definition of "reproducible build"

Hello, Marvin Humphrey skribis: > 2. Hoovering up the build environment into a Docker container or > similar might be enough to produce "reproducible" results, but > without provenance information for the "relevant attributes of the > build environment", the benefits are

[rb-general] Report from the Summit

Hello, Here are notes we Guix folks have taken from the summit: https://gnu.org/s/guix/blog/2018/reproducible-builds-summit-4th-edition/ Thanks again everyone for the fruitful and pleasant event! Ludo’. ___ rb-general@lists.reproducible-builds.org