Reproducible Builds on Windows

[Chris Lamb]

Danilo wrote:

> One aspect that I cannot get rid of is the embedded toolchain 
> information, as well as differing behavior between toolchain versions. 
[…]
> From what I could gather, there is no way to really solve this issue. 
> The approach that we currently plan to implement is to simply declare 
> the toolchain version we used, and let the user deal with the effort to 
> get it installed.

I can't solve your specific problem with the embedded MSVC versions,
but your alternative plan to simply declare the version out-of-band is
the general approach taken in most non-Windows environments. As in,
you would not be doing anything dramatically different from other
platforms.

The claim that "X is reproducible" carries an implicit "given the same
build environment". Most projects declare the toolchain versions by
recording the build environment programmatically and distributing that
info in some way: see [0] for some concrete examples.

For instance, Debian tooling generates a .buildinfo file that
includes the build dependencies along with the versions used. Users
must indeed "deal with the effort" to match that if they want to
reproduce the package.

However, the scriptable packaging tools for Debian and friends make it
relatively straightforward (in theory!!) to programmatically install a
whole bunch of dependencies with specific versions. That might not be
the case under Windows and with VC components.

Intriguingly, the way you couch your "alternative" solution with some
hesitation might suggest asking users to install a specific version
goes against the social norms for that technical platform/community.
I'd be interested to learn about that, as its the kind of "we don't
tend to do that.." thing that does not end up in technical
documentation. :)


  [0] https://reproducible-builds.org/docs/recording/


Best wishes,

-- 
      o
    ⬋   ⬊      Chris Lamb
   o     o     reproducible-builds.org 💠
    ⬊   ⬋
      o