On 19/07/18 08:15, Eli Schwartz wrote:

On 07/18/2018 06:07 PM, Allan McRae wrote:

...

On 19/07/18 02:12, Eli Schwartz wrote:

...

Encode information about the compiler and strip flags used, as these will impact the resulting generated binaries.

Signed-off-by: Eli Schwartz ---

Fairly sure we already rejected this... The assumption is that a distribution is using the default makepkg.conf options unless they are explicitly changed in the PKGBUILD.

I don't recall where we rejected this?

Anyway, reproducibility is not just about reproducing packages created by devtools. It would be nice to be able to reproduce any package. :)

It's also been noted on IRC that we could use it to detect packages built with an *old* makepkg.conf in devtools chroots.

Then you need to include all relevant environmental variables too. And given we don't know which are relevant, we need to include all. Which had privacy implications. Assumptions need to be made for reproducibilty. I'm happy with the package being built in a clean chroot as that assumption. A

On 07/18/2018 06:26 PM, Allan McRae wrote:

Then you need to include all relevant environmental variables too. And given we don't know which are relevant, we need to include all. Which had privacy implications.

Assumptions need to be made for reproducibilty. I'm happy with the package being built in a clean chroot as that assumption.

I'm okay with makepkg only recording the information it is personally responsible for setting in the first place. :) That's what my patch does. If people are creating packages in such a way that the environment outside of makepkg affects the result, then there's really nothing that can handle that -- a thousand different tools have a thousand different boutique configuration files, for example. As long as both packages are built in, and record, some sort of environment where any input to the build process comes exclusively from: - the list of packages installed on the system - the PKGBUILD - makepkg.conf - the public API documented in makepkg(1) -- essentially, BUILDDIR and PKGEXT I will be happy, since makepkg has "done its duty" as far as reproducibility goes. The best way to ensure this is to build packages using a clean user account, but I don't think devtools should be implied, nor should makepkg itself consider reproducible build support to be conditional on devtools/makechrootpkg. -- Eli Schwartz Bug Wrangler and Trusted User