From: Leo Famulari <leo@famulari.name>
To: t3sserakt <t3sserakt@posteo.de>
Cc: help-guix@gnu.org
Subject: Re: Reproducible bootstrapping
Date: Tue, 5 Jul 2016 12:44:55 -0400 [thread overview]
Message-ID: <20160705164455.GC2019@jasmine> (raw)
In-Reply-To: <1c27335b-44ef-ec5b-caad-fce070cb21e7@posteo.de>
On Tue, Jul 05, 2016 at 09:34:30AM +0200, t3sserakt wrote:
> Am 04.07.16 um 18:46 schrieb Efraim Flashner:
>
> > On Mon, Jul 04, 2016 at 06:01:51PM +0200, t3sserakt wrote:
> >> Hi Ludo,
> >>
> >> thx for your quick reply, but no.
> >>
> >> I was talking about reproducible builds like it is mentioned here:
> >>
> >> https://lwn.net/Articles/663954/
> >>
> >> Cheers
> >>
> >> t3sserakt
> >>
> > based on my experience with the aarch64 bootstrap-tarballs,
> > guile-2.0.11.tar.xz and gcc-4.9.3.tar.xz aren't reproducable, but
> > binutils-2.25.1.tar.xz, glibc-2.23.tar.xz and the static-binaries.tar.xz
> > are. After building them twice the later 3 had the same `guix hash'
> > value.
> >
> > From the given tarballs, all the packages should be reproducable, and
> > there's always the `guix challenge' command to check a local build
> > against the one built from the build-farm.
> That means, I can check the bootstrap binaries somehow. It is not that
> comfortable, but it is possible. Is there any place, where you collect
> statements from single developers, that they validated the hashes.
> Reproducible builds only make sense, if a lot of people do this checks,
> and their statement about this can be seen somewhere.
I think it could be a first step to send signed mail containing the
hashes to guix-devel. I'm sure many of us archive all our mail, so we
could always dig up the old messages if the online guix-devel archives
disappear.
next prev parent reply other threads:[~2016-07-05 16:45 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-04 14:00 Reproducible bootstrapping t3sserakt
2016-07-04 15:31 ` Ludovic Courtès
2016-07-04 16:01 ` t3sserakt
2016-07-04 16:46 ` Efraim Flashner
2016-07-05 7:34 ` t3sserakt
2016-07-05 16:44 ` Leo Famulari [this message]
2016-07-11 11:40 ` Ludovic Courtès
2016-07-05 8:11 ` Ludovic Courtès
2016-07-05 8:35 ` t3sserakt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160705164455.GC2019@jasmine \
--to=leo@famulari.name \
--cc=help-guix@gnu.org \
--cc=t3sserakt@posteo.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).