Re: Several questions on Guix(SD)

[Leo Famulari <leo@famulari.name>]

On Thu, Aug 25, 2016 at 11:03:32PM +0200, Björn Höfling wrote:
> Leo, thank you for your answers. I would like some more clarifications:
> 
> On Mon, 22 Aug 2016 17:49:21 -0400
> Leo Famulari <leo@famulari.name> wrote:
> > We don't have much infrastructure for tracking reproducible builds
> > yet. Help wanted!
> > 
> > We do have `guix challenge`, for challenging a binary substitute
> > server. Also, packages can be built with '--rounds=x' and '--check',
> > which repeat the build and compare the outputs to see if they are
> > bit-for-bit identical.
> 
> So you mean you can't tell which builds are not reproducible? Couldn't
> Hydra just build each package two times? Or does that cost too much?

I'm not familiar with the configuration of the Hydra CI system, so I
don't know if it would be easy or hard to make it build everything twice
and check the results.

But, we would still need some infrastructure to remember the results of
the comparison, and to distinguish it from other types of failures, and
I don't _think_ we have that yet.

There is a Google Summer of Code project that aims to replace Hydra with
a Guile Scheme program called Cuirass:
https://notabug.org/mthl/cuirass

We want to support development of Cuirass until we can "dog food" it,
and then we may start building features on top of it such as a
reproducibility checker.

I've CC-ed the Cuirass author in my reply in case he has some comments.
He has also sent some reports the guix-devel mailing list that you may
find interesting.