Research on Reproducible Builds

[Julien Lepiller]

Le 11 février 2020 05:54:13 GMT-05:00, Chris Lamb <chris at reproducible-builds.org> a écrit :
>Dear all,
>
>> Ugh, sorry about that!
>> 
>> It should work now!
>
>Thanks; works for me… as you can see here:
>
>   https://i.imgur.com/UEqbiR4.png
>
>
>Best wishes,
>
>-- 
>      o
>    ⬋   ⬊      Chris Lamb
>   o     o     reproducible-builds.org
>    ⬊   ⬋
>      o
>_______________________________________________
>rb-general at lists.reproducible-builds.org mailing list
>
>To change your subscription options, visit
>https://lists.reproducible-builds.org/listinfo/rb-general.
>
>To unsubscribe, send an email to
>rb-general-unsubscribe at lists.reproducible-builds.org.

Hi Omar,

I was able to download and read the paper after all. It was an interesting read, thanks for posting it here :). If I understand correctly you and your co-authors built a tool, DetTrace, that implements a container technology similar to docker, but whose conception allows for the deterministic behavior of its content. While I have my doubts on containers in general, the introduction resonnated strongly with the guix user inside me :). I think your tool could be seen as a way to transform a process with side-effects into a pure function!

In Guix (and Nix), treating a build procedure as a pure function is the core of the packaging model we use. In fact we already use a similar technology to remove most of the non determinism sources when building (user names and ids, filesystem paths and content, network). I especially liked section 5 with the list of non determinism sources, since it shows where our own tooling is lacking. In fact, I'm pretty sure we could use DetTrace in Guix without too much work, and finally get to 100% reproducibility.

Your evaluation section though suggests that it's not yet practical to use DetTrace for building an entire distribution as ~25% of packages couldn't be built using DetTrace. Do you think it would be a lot of work to get to 0%? Do you plan to improve it?

Let me know when your tool is available, as I'd like to experiment with it :).