On Wed, Oct 07, 2020 at 11:04:13PM -0400, Kyle Meyer wrote:
> On 10/07/20 12:35:51 +0200, zimoun wrote:
> > Dear,
> >
> > Using Guix 04a459a, the package ’git-annex’ is not reproducible:
> >
> >   guix build git-annex
> >   guix build git-annex --no-grafts --check -K
> >
> > return:
> >
> > --8<---------------cut here---------------start------------->8---
> > guix build: error: derivation `/gnu/store/70qkv5hi5yq20m1h9jfm17m5lsc235mk-git-annex-8.20200908.drv' may not be deterministic: output `/gnu/store/cbrwrlwx6kg7l5q6ifl7q08icm17704g-git-annex-8.20200908' differs from ‘/gnu/store/cbrwrlwx6kg7l5q6ifl7q08icm17704g-git-annex-8.20200908-check’
> > --8<---------------cut here---------------end--------------->8---
> >
> > then:
> >
> > --8<---------------cut here---------------start------------->8---
> > $ diff -r --no-dereference /gnu/store/cbrwrlwx6kg7l5q6ifl7q08icm17704g-git-annex-8.20200908{,-check}
> > Binary files /gnu/store/cbrwrlwx6kg7l5q6ifl7q08icm17704g-git-annex-8.20200908/bin/git-annex and /gnu/store/cbrwrlwx6kg7l5q6ifl7q08icm17704g-git-annex-8.20200908-check/bin/git-annex differ
> > --8<---------------cut here---------------end--------------->8---
> >
> > Is it expected?  I have not tried ’diffoscope’ yet to investigate.
> 
> Thanks for noticing.  I see the same on my end (and also with the
> git-annex update [1] that I submitted before I saw this message).
> 
> I suspect this is a relatively new issue, as I've run `build --check'
> successfully on git-annex in the past.  The git-annex definition prior
> to the one above was introduced with e13fefbcff (gnu: git-annex: Create
> fake static output, 2020-08-17).  On that commit, the check also failed
> for me:
> 
>     $ guix time-machine --commit=e13fefbcffa50144d9301d67b61928ac3c964fb3 -- build --no-grafts --check git-annex
>     guix build: error: derivation `/gnu/store/5illriaaijqrhl17aymzgiw6wzaq666s-git-annex-8.20200810.drv' may not be deterministic: output `/gnu/store/32h0xbqdwkm22naqba10fk9124cdgw9q-git-annex-8.20200810' differs
> 
> However, going back one more to 35e24fab73 (gnu: git-annex: Update to
> 8.20200810, 2020-08-11), the check was successful:
> 
>     $ guix time-machine --commit=35e24fab73bc450c6e0d3b9a5bbdfa88d2c425f4 -- build --no-grafts --check git-annex
>     [...]
>     /gnu/store/m79ri0g2s3d8pk52ysjkdvallk2zqbwb-git-annex-8.20200810
> 
> 
> [1]: bug#43854: <20201007204946.22878-1-kyle@kyleam.com>
> 

In between those two commits is also the change to the haskell build
system update, where we use the dynamic libraries. The best bet is to
make sure the dependencies are built reproducibly.

-- 
Efraim Flashner   <efraim@flashner.co.il>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted