From mboxrd@z Thu Jan  1 00:00:00 1970
From: Leo Famulari <leo@famulari.name>
Subject: Re: Reproducible bootstrapping
Date: Tue, 5 Jul 2016 12:44:55 -0400
Message-ID: <20160705164455.GC2019@jasmine>
References: <dd04fbde305e89bdc69806102c102633@posteo.de>
	<874m85ctdj.fsf@gnu.org>
	<25ed67bc-3e51-b223-69a7-1bf4fec84a50@posteo.de>
	<20160704164617.GA23163@debian-netbook>
	<1c27335b-44ef-ec5b-caad-fce070cb21e7@posteo.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Return-path: <help-guix-bounces+gcggh-help-guix=m.gmane.org@gnu.org>
Received: from eggs.gnu.org ([2001:4830:134:3::10]:46831)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <leo@famulari.name>) id 1bKTTG-0006Nn-5S
	for help-guix@gnu.org; Tue, 05 Jul 2016 12:45:15 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <leo@famulari.name>) id 1bKTTA-0007NU-Uc
	for help-guix@gnu.org; Tue, 05 Jul 2016 12:45:13 -0400
Received: from out3-smtp.messagingengine.com ([66.111.4.27]:60205)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <leo@famulari.name>) id 1bKTT9-0007CJ-4z
	for help-guix@gnu.org; Tue, 05 Jul 2016 12:45:08 -0400
Content-Disposition: inline
In-Reply-To: <1c27335b-44ef-ec5b-caad-fce070cb21e7@posteo.de>
List-Id: <help-guix.gnu.org>
List-Unsubscribe: <https://lists.gnu.org/mailman/options/help-guix>,
	<mailto:help-guix-request@gnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/archive/html/help-guix/>
List-Post: <mailto:help-guix@gnu.org>
List-Help: <mailto:help-guix-request@gnu.org?subject=help>
List-Subscribe: <https://lists.gnu.org/mailman/listinfo/help-guix>,
	<mailto:help-guix-request@gnu.org?subject=subscribe>
Errors-To: help-guix-bounces+gcggh-help-guix=m.gmane.org@gnu.org
Sender: "Help-Guix" <help-guix-bounces+gcggh-help-guix=m.gmane.org@gnu.org>
To: t3sserakt <t3sserakt@posteo.de>
Cc: help-guix@gnu.org

On Tue, Jul 05, 2016 at 09:34:30AM +0200, t3sserakt wrote:
> Am 04.07.16 um 18:46 schrieb Efraim Flashner:
> 
> > On Mon, Jul 04, 2016 at 06:01:51PM +0200, t3sserakt wrote:
> >> Hi Ludo,
> >>
> >> thx for your quick reply, but no.
> >>
> >> I was talking about reproducible builds like it is mentioned here:
> >>
> >> https://lwn.net/Articles/663954/
> >>
> >> Cheers
> >>
> >> t3sserakt
> >>
> > based on my experience with the aarch64 bootstrap-tarballs,
> > guile-2.0.11.tar.xz and gcc-4.9.3.tar.xz aren't reproducable, but
> > binutils-2.25.1.tar.xz, glibc-2.23.tar.xz and the static-binaries.tar.xz
> > are. After building them twice the later 3 had the same `guix hash'
> > value.
> >
> > From the given tarballs, all the packages should be reproducable, and
> > there's always the `guix challenge' command to check a local build
> > against the one built from the build-farm.
> That means, I can check the bootstrap binaries somehow. It is not that
> comfortable, but it is possible. Is there any place, where you collect
> statements from single developers, that they validated the hashes.
> Reproducible builds only make sense, if a lot of people do this checks,
> and their statement about this can be seen somewhere.

I think it could be a first step to send signed mail containing the
hashes to guix-devel. I'm sure many of us archive all our mail, so we
could always dig up the old messages if the online guix-devel archives
disappear.