<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Oct 23, 2021, at 1:51 PM, Keith Smiley <<a href="mailto:keithbsmiley@gmail.com" class="">keithbsmiley@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="auto" class="">Here is an issue <div dir="auto" class=""><a href="https://github.com/easybuilders/easybuild-easyconfigs/issues/5151" class="">https://github.com/easybuilders/easybuild-easyconfigs/issues/5151</a> with a lot of other referenced issues, about the one time I remember this happening. Folks in the bazel community reference this issue a lot since the default behavior of folks is to use the generate tarball URL and pin those shas in their builds.</div></div><div class=""><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Oct 23, 2021 at 8:22 AM Arthur Gautier <<a href="mailto:baloo@superbaloo.net" class="">baloo@superbaloo.net</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Sat, Oct 23, 2021 at 9:52 AM Martin Monperrus<br class="">
<<a href="mailto:martin.monperrus@gnieh.org" target="_blank" class="">martin.monperrus@gnieh.org</a>> wrote:<br class="">
><br class="">
> Dear all,<br class="">
><br class="">
> FYI, Github's autogenerated release tarballs are not deterministic (see discussion on keybase, and Bitcoin-core release warning).<br class="">
><br class="">
> Does anybody have good connections at Github to get this fixed?<br class=""></blockquote></div></div></div></blockquote></div><div class=""><br class=""></div>A build is deterministic if it produces the same results for a specific set of tool versions & platform.<div class="">Tool changes eliminate that. You should expect, for example, that an updated compiler will generate different results.<div class=""><br class=""></div><div class="">A given version of tar should produce deterministic results. However, if tar is updated, it’s not really</div><div class="">reasonable to expect that the result will be identical.</div><div class=""><br class=""></div><div class="">It’s reasonable for GitHub to change its default tar implementation. What would you suggest as an alternative?</div><div class=""><br class=""></div><div class="">--- David A. Wheeler</div><div class=""><br class=""></div></div></body></html>