From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: Reproducible bootstrapping Date: Mon, 11 Jul 2016 13:40:11 +0200 Message-ID: <878tx8mmhw.fsf@gnu.org> References: <874m85ctdj.fsf@gnu.org> <25ed67bc-3e51-b223-69a7-1bf4fec84a50@posteo.de> <20160704164617.GA23163@debian-netbook> <1c27335b-44ef-ec5b-caad-fce070cb21e7@posteo.de> <20160705164455.GC2019@jasmine> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:46273) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bMZZU-0005Fl-4X for help-guix@gnu.org; Mon, 11 Jul 2016 07:40:21 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bMZZQ-0004vL-Rt for help-guix@gnu.org; Mon, 11 Jul 2016 07:40:20 -0400 In-Reply-To: <20160705164455.GC2019@jasmine> (Leo Famulari's message of "Tue, 5 Jul 2016 12:44:55 -0400") List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: help-guix-bounces+gcggh-help-guix=m.gmane.org@gnu.org Sender: "Help-Guix" To: Leo Famulari Cc: help-guix@gnu.org, t3sserakt Leo Famulari skribis: > On Tue, Jul 05, 2016 at 09:34:30AM +0200, t3sserakt wrote: >> Am 04.07.16 um 18:46 schrieb Efraim Flashner: >>=20 >> > On Mon, Jul 04, 2016 at 06:01:51PM +0200, t3sserakt wrote: >> >> Hi Ludo, >> >> >> >> thx for your quick reply, but no. >> >> >> >> I was talking about reproducible builds like it is mentioned here: >> >> >> >> https://lwn.net/Articles/663954/ >> >> >> >> Cheers >> >> >> >> t3sserakt >> >> >> > based on my experience with the aarch64 bootstrap-tarballs, >> > guile-2.0.11.tar.xz and gcc-4.9.3.tar.xz aren't reproducable, but >> > binutils-2.25.1.tar.xz, glibc-2.23.tar.xz and the static-binaries.tar.= xz >> > are. After building them twice the later 3 had the same `guix hash' >> > value. >> > >> > From the given tarballs, all the packages should be reproducable, and >> > there's always the `guix challenge' command to check a local build >> > against the one built from the build-farm. >> That means, I can check the bootstrap binaries somehow. It is not that >> comfortable, but it is possible. Is there any place, where you collect >> statements from single developers, that they validated the hashes. >> Reproducible builds only make sense, if a lot of people do this checks, >> and their statement about this can be seen somewhere. > > I think it could be a first step to send signed mail containing the > hashes to guix-devel. I'm sure many of us archive all our mail, so we > could always dig up the old messages if the online guix-devel archives > disappear. An idea that has been floating around is that users or independent organizations could publish substitutes, which are signed. We could then archive signatures for each substitutes. For reproducible packages, we=E2=80=99d have several independent signatures for a given package/hash pair. Ludo=E2=80=99.