Re: Reproducible builds: a means to an end

[Ricardo Wurmus <ricardo.wurmus@mdc-berlin.de>]

Ludovic Courtès <ludo@gnu.org> writes:

> I published a note on how I think reproducible builds fit in the bigger
> picture of user freedom and user autonomy, and what role Guix can play:
>
>   https://savannah.gnu.org/forum/forum.php?forum_id=8407

That was a very nice read!

I wonder how we as a project could help the reproducible builds project
and/or directly benefit from their findings.  Are there ready-made
patches we could apply to our package recipes?  Or should we just wait
for upstream projects to be fixed?

The utility of “guix challenge” is much reduced when for so many
packages we do not actually have reproducible builds.

(Maybe we could have a page that lists packages that “guix challenge”
suggests as having non-reproducible builds.)

Can we automate some fixes, such as disabling timestamps?  (I see, for
example, that the Python REPL tells me when it was built.)

~~ Ricardo