From mboxrd@z Thu Jan 1 00:00:00 1970 From: t3sserakt Subject: Re: Reproducible bootstrapping Date: Tue, 5 Jul 2016 09:34:30 +0200 Message-ID: <1c27335b-44ef-ec5b-caad-fce070cb21e7@posteo.de> References: <874m85ctdj.fsf@gnu.org> <25ed67bc-3e51-b223-69a7-1bf4fec84a50@posteo.de> <20160704164617.GA23163@debian-netbook> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:55526) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bKKsY-0001Vq-6o for help-guix@gnu.org; Tue, 05 Jul 2016 03:34:47 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bKKsT-0000ev-Vq for help-guix@gnu.org; Tue, 05 Jul 2016 03:34:45 -0400 Received: from mout02.posteo.de ([185.67.36.66]:39785) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bKKsT-0000el-Pc for help-guix@gnu.org; Tue, 05 Jul 2016 03:34:41 -0400 Received: from submission (posteo.de [89.146.220.130]) by mout02.posteo.de (Postfix) with ESMTPS id B236B20B98 for ; Tue, 5 Jul 2016 09:34:38 +0200 (CEST) In-Reply-To: <20160704164617.GA23163@debian-netbook> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: help-guix-bounces+gcggh-help-guix=m.gmane.org@gnu.org Sender: "Help-Guix" To: Efraim Flashner Cc: help-guix@gnu.org Am 04.07.16 um 18:46 schrieb Efraim Flashner: > On Mon, Jul 04, 2016 at 06:01:51PM +0200, t3sserakt wrote: >> Hi Ludo, >> >> thx for your quick reply, but no. >> >> I was talking about reproducible builds like it is mentioned here: >> >> https://lwn.net/Articles/663954/ >> >> Cheers >> >> t3sserakt >> > based on my experience with the aarch64 bootstrap-tarballs, > guile-2.0.11.tar.xz and gcc-4.9.3.tar.xz aren't reproducable, but > binutils-2.25.1.tar.xz, glibc-2.23.tar.xz and the static-binaries.tar.x= z > are. After building them twice the later 3 had the same `guix hash' > value. > > From the given tarballs, all the packages should be reproducable, and > there's always the `guix challenge' command to check a local build > against the one built from the build-farm. That means, I can check the bootstrap binaries somehow. It is not that comfortable, but it is possible. Is there any place, where you collect statements from single developers, that they validated the hashes. Reproducible builds only make sense, if a lot of people do this checks, and their statement about this can be seen somewhere. t3sserakt