From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ricardo Wurmus Subject: Re: Reproducible builds: a means to an end Date: Mon, 16 Nov 2015 15:44:40 +0100 Message-ID: References: <87bnb0egb1.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:44230) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZyL1Y-0006cZ-Kw for guix-devel@gnu.org; Mon, 16 Nov 2015 09:44:53 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZyL1U-0006Vo-Ff for guix-devel@gnu.org; Mon, 16 Nov 2015 09:44:52 -0500 In-Reply-To: <87bnb0egb1.fsf@gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: Ludovic =?utf-8?Q?Court=C3=A8s?= Cc: guix-devel Ludovic Court=C3=A8s writes: > I published a note on how I think reproducible builds fit in the bigger > picture of user freedom and user autonomy, and what role Guix can play: > > https://savannah.gnu.org/forum/forum.php?forum_id=3D8407 That was a very nice read! I wonder how we as a project could help the reproducible builds project and/or directly benefit from their findings. Are there ready-made patches we could apply to our package recipes? Or should we just wait for upstream projects to be fixed? The utility of =E2=80=9Cguix challenge=E2=80=9D is much reduced when for = so many packages we do not actually have reproducible builds. (Maybe we could have a page that lists packages that =E2=80=9Cguix challe= nge=E2=80=9D suggests as having non-reproducible builds.) Can we automate some fixes, such as disabling timestamps? (I see, for example, that the Python REPL tells me when it was built.) ~~ Ricardo