[gentoo-dev] reproducible builds

[gentoo-dev] reproducible builds

[Samuel Bernardo]

Hi,

I send this email to know the opinion of gentoo developers about
registering gentoo profiles in the context of reproducible-builds.org

Cheers

Re: [gentoo-dev] reproducible builds

[Matt Turner]

On Sun, Feb 4, 2018 at 7:25 AM, Samuel Bernardo
<samuelbernardo.mail@gmail.com> wrote:
> Hi,
>
> I send this email to know the opinion of gentoo developers about
> registering gentoo profiles in the context of reproducible-builds.org

Reproducible builds makes sense when you're distributing binaries to
users. That's not typically the case with Gentoo.

What would this even mean in the context of a source-based distro?

Re: [gentoo-dev] reproducible builds

[Canek Peláez Valdés]

[-- Attachment #1: Type: text/plain, Size: 790 bytes --]

On Feb 4, 2018 12:04, "Matt Turner" <mattst88@gentoo.org> wrote:

On Sun, Feb 4, 2018 at 7:25 AM, Samuel Bernardo
<samuelbernardo.mail@gmail.com> wrote:
> Hi,
>
> I send this email to know the opinion of gentoo developers about
> registering gentoo profiles in the context of reproducible-builds.org

Reproducible builds makes sense when you're distributing binaries to
users. That's not typically the case with Gentoo.

What would this even mean in the context of a source-based distro?


It would mean that we all could reproduce the exact same bugs given the
CFLAGS/USE/etc. combination.

Many groups are working on this from different fronts; if the results
stabilize at some point, Gentoo could use that to at least give the users
the option of enabling reproducible builds.

Regards.

[-- Attachment #2: Type: text/html, Size: 1693 bytes --]

Re: [gentoo-dev] reproducible builds

[Marc Schiffbauer]

[-- Attachment #1: Type: text/plain, Size: 970 bytes --]

* Matt Turner schrieb am 04.02.18 um 19:04 Uhr:
> On Sun, Feb 4, 2018 at 7:25 AM, Samuel Bernardo
> <samuelbernardo.mail@gmail.com> wrote:
> > Hi,
> >
> > I send this email to know the opinion of gentoo developers about
> > registering gentoo profiles in the context of reproducible-builds.org
> 
> Reproducible builds makes sense when you're distributing binaries to
> users. 

+1 .. and I just wanted to add that this might be something very 
valuable if you want some sort of public binhost like it is the case in 
another current thread on this list.

I would think of a giantic cache. If someone else already has built a 
reproducable bin-package of an ebuild with the exact same 
profile/USE/binutils/gcc/... combination that I am using too, then this 
would be something very useful IMO which saves a lot of buildtime and 
energy.

-Marc


-- 
0xCA3E7BF67F979BE5 - F7FB 78F7 7CC3 79F6 DF07
                     6E9E CA3E 7BF6 7F97 9BE5

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-dev] reproducible builds

[Matthew Thode]

[-- Attachment #1: Type: text/plain, Size: 1124 bytes --]

On 18-02-04 19:20:33, Marc Schiffbauer wrote:
> * Matt Turner schrieb am 04.02.18 um 19:04 Uhr:
> > On Sun, Feb 4, 2018 at 7:25 AM, Samuel Bernardo
> > <samuelbernardo.mail@gmail.com> wrote:
> > > Hi,
> > >
> > > I send this email to know the opinion of gentoo developers about
> > > registering gentoo profiles in the context of reproducible-builds.org
> > 
> > Reproducible builds makes sense when you're distributing binaries to
> > users. 
> 
> +1 .. and I just wanted to add that this might be something very 
> valuable if you want some sort of public binhost like it is the case in 
> another current thread on this list.
> 
> I would think of a giantic cache. If someone else already has built a 
> reproducable bin-package of an ebuild with the exact same 
> profile/USE/binutils/gcc/... combination that I am using too, then this 
> would be something very useful IMO which saves a lot of buildtime and 
> energy.
> 

Yes, I think a lot of the same stuff could go into our build system.
Simple stuff like using the same date for things for instance.

-- 
Matthew Thode (prometheanfire)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-dev] reproducible builds

[Samuel Bernardo]

[-- Attachment #1: Type: text/plain, Size: 1486 bytes --]

On 02/04/2018 06:14 PM, Canek Peláez Valdés wrote:
>
>
>     What would this even mean in the context of a source-based distro?
>
>
> It would mean that we all could reproduce the exact same bugs given
> the CFLAGS/USE/etc. combination.
>
> Many groups are working on this from different fronts; if the results
> stabilize at some point, Gentoo could use that to at least give the
> users the option of enabling reproducible builds.
+1

That was exactly what I found interesting.
There is also some best practices that are pointed in the documentation
that seems to be useful for achieving the deterministic build:
https://reproducible-builds.org/docs/

Gentoo is a source based distro but the build environments and profiles
are many times the challenge that trigger most of bug reports in bugzilla.
With the reference reproducible build for some ebuild or profile would
allow to review the details of portage configuration that could be the
cause of the compile failures. This would be very useful for keyword
masked packages and for those that desire to be bleeding edge. Also for
overlays that would be qualiity assured by the reproducible builds over
EAPI verification.

I'm convinced that some of the ideas would be useful even for a souce
based distribution. In a source distribution I think that this would be
simple when comparing to binary distributions. All necessary information
would be collected directly from emerge and published as is.

Thanks to all for the feedback

[-- Attachment #2: Type: text/html, Size: 2444 bytes --]