This is the mail archive of the
cygwin
mailing list for the Cygwin project.
Re: Deterministic builds
- From: Warren Young <wyml at etr-usa dot com>
- To: The Cygwin Mailing List <cygwin at cygwin dot com>
- Date: Thu, 5 May 2016 14:26:35 -0600
- Subject: Re: Deterministic builds
- Authentication-results: sourceware.org; auth=none
- References: <ff5f5b20-33e2-ef2d-012a-a9e02903ba21 at cornell dot edu> <CAFo71_4uBbNZ6JakbNE3mJ3HgvFRnFa-dK+GSrNdpmds1iXzow at mail dot gmail dot com> <258af4b4-e1f0-171c-4b94-772603038fde at cornell dot edu> <c69da505-542a-0256-46d9-f35a379c3443 at cornell dot edu>
On May 5, 2016, at 11:59 AM, Ken Brown <kbrown@cornell.edu> wrote:
>
> Ismail's suggestion did indeed produce deterministic builds in my setup. I built a large project with about 150 executables, changed a few source files, removed the build directory, rebuilt, and found that only the (expected) few executables changed.
âand does it do the same on a very different system? e.g. Try it on both 64-bit Windows 10 and on 32-bit Windows 7.
Perhaps you donât need it, but part of the reason for the big push recently for reproducible builds is to be able to verify that binaries from a given source (e.g. Red Hatâs RPM feed) are in fact buildable from the sources distributed from the same source (e.g. Red Hatâs SRPMs).
The usual motivation for that is security: itâs no good receiving an SRPM with a security patch if the binary that yum installs still has the bug.
Therefore, if you get âreproducibleâ builds on only a single machine, you may not have achieved any useful result.
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple