From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 8E24A1382C5 for ; Sun, 4 Feb 2018 21:56:12 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id A604EE0A60; Sun, 4 Feb 2018 21:56:06 +0000 (UTC) Received: from mail-wm0-x230.google.com (mail-wm0-x230.google.com [IPv6:2a00:1450:400c:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 33A87E0A00 for ; Sun, 4 Feb 2018 21:56:06 +0000 (UTC) Received: by mail-wm0-x230.google.com with SMTP id v71so22291518wmv.2 for ; Sun, 04 Feb 2018 13:56:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language; bh=N0ltqW+gO/U0TY/XyedzOpxTCCAAimBftrI8Lfh8LXA=; b=l9amSbeS9dUxuGEiMnULxJ21gglHwh+se2yHn4GbPhliR9rurq+PHSnP6TO1O2bnyE 41xhrg/P+9hjxbFFuSxwzVq9bYkVyyAIqOZpK5Q/ijXEul5+d2Bwm2NvLh2l8w/Gp7as gPHIrz4gRNTMfKwv59B9ZkdpqarZj3KliuKhHOyZsHKRn/iiMjFuHvYKsiK2LeBO+UB0 h/MuIJl4T2YIo8g2wH+/a6PQK9iePIEHSg6c2WLIagJMc94XL+q964nyc3CFtHwvi0/W Lf5pyOpysSt3UwqrjlLrIe7Ix+mgR5QPVGgUVXXD0T454MtMvIoY0L4qRNX9xjnU5TXJ sOQg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language; bh=N0ltqW+gO/U0TY/XyedzOpxTCCAAimBftrI8Lfh8LXA=; b=U7RHBBC3oOYgpPp/4AkjX+ZF6rrfsj8dcXTG6XkNKN+9CSMLK43K89hGwdluMbzVaJ pZVPrDXE096Z+RtvwGzaEXHKG/o4vLRlyavMBjDL0dGlWkIVh4BRobWKAW7IOU2SDIuI uYHUHOPUckwNI5j9nxsLH2S6o3WnZXgXb6uZ2tY5HoHELjdh/NpbjaMcqjl6LyNlC7Iv 3htpotXTpXdPmBN1bcK08iA64SFkzbhYfwQul0lwZGBsDP7RKBhhxnu9/CEeJgbgDNC6 1U2s1kWKDQy4TrZF/o1weIP7rczMS7uQGsJKoWbhggBTyG25MFZdngzP8mqedczU3Nhl CZUg== X-Gm-Message-State: AKwxytdyDuiArTCJDEpmt19w/oZZu5GEZhP4Tn6XC44LNmG4wohOMQeJ iMbHHQhi8f2PA6ru4TwqQLw85jmd X-Google-Smtp-Source: AH8x224h9HUsAvje47OMrWlyM6FgjyTSdk2NRp4n/d9U+UzAUNjAa2Ymjmj2Tc+3rkRO2GYz2f2p8Q== X-Received: by 10.80.225.3 with SMTP id h3mr75341118edl.194.1517781364574; Sun, 04 Feb 2018 13:56:04 -0800 (PST) Received: from [192.168.0.1] (a85-138-6-72.cpe.netcabo.pt. [85.138.6.72]) by smtp.gmail.com with ESMTPSA id v23sm5736715eda.92.2018.02.04.13.56.03 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 04 Feb 2018 13:56:04 -0800 (PST) Subject: Re: [gentoo-dev] reproducible builds To: gentoo-dev@lists.gentoo.org References: <71358ee6-0b56-d18e-9a5a-3d06feb8771f@gmail.com> From: Samuel Bernardo Message-ID: <2533a01b-b92b-adc7-1c4e-a3d6d5a26efa@gmail.com> Date: Sun, 4 Feb 2018 21:56:02 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------A080B8E8A1300EF63D878A97" Content-Language: en-US X-Archives-Salt: 8e8c8c74-a682-4237-9779-2e0526487cf7 X-Archives-Hash: 6eaf1346d30ec5d1e4f5ae5e567c0db8 This is a multi-part message in MIME format. --------------A080B8E8A1300EF63D878A97 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit On 02/04/2018 06:14 PM, Canek Peláez Valdés wrote: > > > What would this even mean in the context of a source-based distro? > > > It would mean that we all could reproduce the exact same bugs given > the CFLAGS/USE/etc. combination. > > Many groups are working on this from different fronts; if the results > stabilize at some point, Gentoo could use that to at least give the > users the option of enabling reproducible builds. +1 That was exactly what I found interesting. There is also some best practices that are pointed in the documentation that seems to be useful for achieving the deterministic build: https://reproducible-builds.org/docs/ Gentoo is a source based distro but the build environments and profiles are many times the challenge that trigger most of bug reports in bugzilla. With the reference reproducible build for some ebuild or profile would allow to review the details of portage configuration that could be the cause of the compile failures. This would be very useful for keyword masked packages and for those that desire to be bleeding edge. Also for overlays that would be qualiity assured by the reproducible builds over EAPI verification. I'm convinced that some of the ideas would be useful even for a souce based distribution. In a source distribution I think that this would be simple when comparing to binary distributions. All necessary information would be collected directly from emerge and published as is. Thanks to all for the feedback --------------A080B8E8A1300EF63D878A97 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit On 02/04/2018 06:14 PM, Canek Peláez Valdés wrote:

What would this even mean in the context of a source-based distro?

It would mean that we all could reproduce the exact same bugs given the CFLAGS/USE/etc. combination.

Many groups are working on this from different fronts; if the results stabilize at some point, Gentoo could use that to at least give the users the option of enabling reproducible builds.
+1

That was exactly what I found interesting.
There is also some best practices that are pointed in the documentation that seems to be useful for achieving the deterministic build:
https://reproducible-builds.org/docs/

Gentoo is a source based distro but the build environments and profiles are many times the challenge that trigger most of bug reports in bugzilla.
With the reference reproducible build for some ebuild or profile would allow to review the details of portage configuration that could be the cause of the compile failures. This would be very useful for keyword masked packages and for those that desire to be bleeding edge. Also for overlays that would be qualiity assured by the reproducible builds over EAPI verification.

I'm convinced that some of the ideas would be useful even for a souce based distribution. In a source distribution I think that this would be simple when comparing to binary distributions. All necessary information would be collected directly from emerge and published as is.

Thanks to all for the feedback
--------------A080B8E8A1300EF63D878A97--