Support reproducible builds in the Makefile #3390
Conversation
Build artifacts embeds the current date of the build into the artifact. If anyone want to reproduce the software at a later date there is no way to pass a recorded date or fake it in the build system at a later point. https://reproducible-builds.org/docs/source-date-epoch/ Signed-off-by: Morten Linderud <morten@linderud.pw>
An issue for achieving reproducible builds is build artifacts where build paths are embedded. We remove them by passing the current working directory to -gcflags and -asmflags which prefix trims the paths. Note: Go 1.13 includes `-trimpath` https://reproducible-builds.org/docs/build-path/ Signed-off-by: Morten Linderud <morten@linderud.pw>
openshift-ci-robot
added
size/S
needs-ok-to-test
|
Hi @Foxboron. Thanks for your PR. I'm waiting for a containers or openshift member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
Can one of the admins verify this patch?
|
|
/ok-to-test |
openshift-ci-robot
added
ok-to-test
and removed
needs-ok-to-test
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Foxboron, mheon The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci-robot
added
the
approved
|
Changes LGTM, but I'd like it if someone more familiar with makefiles could do a final review |
|
We don't have GO 1.13 in Fedora yet. But it looks like the tests are passing. /lgtm |
Found two issues in the current
Makefilewhere podman builds are not reproducible. There are several build times embedded to build artifacts, made sure these adhere toSOURCE_DATE_EPOCH. Builds paths are also trimmed with-gcflagsand-asmflagsso we can reproduce them without caring about build path differences.https://reproducible-builds.org/