help-guix
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Reproducible bootstrapping


From: t3sserakt
Subject: Re: Reproducible bootstrapping
Date: Tue, 5 Jul 2016 09:34:30 +0200
User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.1.1

Am 04.07.16 um 18:46 schrieb Efraim Flashner:

> On Mon, Jul 04, 2016 at 06:01:51PM +0200, t3sserakt wrote:
>> Hi Ludo,
>>
>> thx for your quick reply, but no.
>>
>> I was talking about reproducible builds like it is mentioned here:
>>
>> https://lwn.net/Articles/663954/
>>
>> Cheers
>>
>> t3sserakt
>>
> based on my experience with the aarch64 bootstrap-tarballs,
> guile-2.0.11.tar.xz and gcc-4.9.3.tar.xz aren't reproducable, but
> binutils-2.25.1.tar.xz, glibc-2.23.tar.xz and the static-binaries.tar.xz
> are. After building them twice the later 3 had the same `guix hash'
> value.
>
> From the given tarballs, all the packages should be reproducable, and
> there's always the `guix challenge' command to check a local build
> against the one built from the build-farm.
That means, I can check the bootstrap binaries somehow. It is not that
comfortable, but it is possible. Is there any place, where you collect
statements from single developers, that they validated the hashes.
Reproducible builds only make sense, if a lot of people do this checks,
and their statement about this can be seen somewhere.

t3sserakt




reply via email to

[Prev in Thread] Current Thread [Next in Thread]