Reproducible packages on macOS, Windows (and also Linux)

[Nichita Morcotilo]

Dear Reproducible Builds,

I am reaching out for two reasons:

The first one is to show you our efforts to build reproducible packages
cross-platform with a new build tool called "rattler-build
<https://github.com/prefix-dev/rattler-build>". The tool itself creates
`conda` packages which are cross-platform, system level, binary packages.
As you can imagine, building packages reproducibly on Windows is the
hardest challenge (so far!). We've created a list of 100 recipes for now
... and we're testing / rebuilding packages in Github Actions CI
<https://github.com/prefix-dev/reproducible-builds>.

You can find the table and diagram on the following website:
https://prefix-dev.github.io/reproducible-builds/

The second reason is that we've been semi-successful with Apple. It seems
that a number of tools from the Apple ecosystem are not aware of
`SOURCE_DATE_EPOCH` but instead use `ZERO_AR_DATE`. We're wondering if
someone else is working on reproducing binary packages on macOS? The
downside of ZERO_AR_DATE is that it zeroes out the timestamp, while
SOURCE_DATE_EPOCH can use some "reasonable, but deterministic" timestamp
(which we would prefer).

We did send one PR to a fork of Apple's tools to add SOURCE_DATE_EPOCH  (
https://github.com/tpoechtrager/cctools-port/pull/140), but there are a few
more places in `cctools` that need fixing and ideally this would go
upstream to Apple.

Any chance someone knows someone that knows someone etc?! :)

We believe these changes could significantly improve the reproducibility of
builds using cctools, benefiting not only rattler-build but potentially the
broader community working on reproducible builds.

Thank you for your time and support.


Best regards,
Nichita Morcotilo
prefix.dev Team
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-general/attachments/20240703/be83d0ad/attachment.htm>