Re: Reproducible bootstrapping

[Leo Famulari <leo@famulari.name>]

On Tue, Jul 05, 2016 at 09:34:30AM +0200, t3sserakt wrote:
> Am 04.07.16 um 18:46 schrieb Efraim Flashner:
> 
> > On Mon, Jul 04, 2016 at 06:01:51PM +0200, t3sserakt wrote:
> >> Hi Ludo,
> >>
> >> thx for your quick reply, but no.
> >>
> >> I was talking about reproducible builds like it is mentioned here:
> >>
> >> https://lwn.net/Articles/663954/
> >>
> >> Cheers
> >>
> >> t3sserakt
> >>
> > based on my experience with the aarch64 bootstrap-tarballs,
> > guile-2.0.11.tar.xz and gcc-4.9.3.tar.xz aren't reproducable, but
> > binutils-2.25.1.tar.xz, glibc-2.23.tar.xz and the static-binaries.tar.xz
> > are. After building them twice the later 3 had the same `guix hash'
> > value.
> >
> > From the given tarballs, all the packages should be reproducable, and
> > there's always the `guix challenge' command to check a local build
> > against the one built from the build-farm.
> That means, I can check the bootstrap binaries somehow. It is not that
> comfortable, but it is possible. Is there any place, where you collect
> statements from single developers, that they validated the hashes.
> Reproducible builds only make sense, if a lot of people do this checks,
> and their statement about this can be seen somewhere.

I think it could be a first step to send signed mail containing the
hashes to guix-devel. I'm sure many of us archive all our mail, so we
could always dig up the old messages if the online guix-devel archives
disappear.