Re: Reproducible installation images

[Mark H Weaver <mhw@netris.org>]

ludo@gnu.org (Ludovic Courtès) writes:

> Mark H Weaver <mhw@netris.org> skribis:
>
>> ludo@gnu.org (Ludovic Courtès) writes:
>>
>>> Mark H Weaver <mhw@netris.org> skribis:
>>>
>>>> To enable independent verification of these installer images, it would
>>>> be helpful to include the precise commands needed to reproduce these
>>>> images, and the git commit to run them on.
>>>>
>>>> What do you think?
>>>
>>> The manual already gives those commands:
>>>
>>>   https://www.gnu.org/software/guix/manual/html_node/Binary-Installation.html (bottom)
>>>   https://www.gnu.org/software/guix/manual/html_node/Building-the-Installation-Image.html
>>
>> They give the commands, but they do not provide the git commit that you
>> ran these commands on.
>
> True.  So the announcements could say something like:
>
>   See the “Binary Installation” and “Building the Installation Image”
>   sections of the manual on how to recreate these binary images.  The
>   ‘guix-binary’ tarballs were created from the ‘v0.14.0’ Git tag; the
>   ‘guixsd-’ images were created from the tip of the ‘version-0.14.0’
>   branch.

This looks good, except for the "tip of the ‘version-0.14.0’ branch"
reference, which may change over time.  Ideally, the commit references
should be reliably immutable.

What do you think?

      Mark