Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding support for reproducible builds. #163

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

dev-d
Copy link

@dev-d dev-d commented Feb 10, 2022

This PR adds optional support for ensuring that two RPMs created from the same source code create the exact same byte-for-byte RPM output. See https://reproducible-builds.org/ for details on why such a feature has value.

The only change that is needed in Redline to support this is to provide an override where the "Date Built" can be overridden by an environment variable.

The environment variable chosen follows the spec defined at https://reproducible-builds.org/docs/source-date-epoch/ . Therefore, you can override the default built date with the env variable SOURCE_DATE_EPOCH

A unit test is added to verify this new behavior by injecting a test environment variable.

If this PR is accepted, we may list this library to https://reproducible-builds.org/docs/jvm/

Limitations:

  • Redline will still create different RPMs if the order in which files are added into the Builder are changed. However, that is not something that changes when redline is executed on different environments.
  • Make sure that the binaries that you package using Redline themselves are reproducible builds.

@craigwblake
Copy link
Owner

Thanks for the contribution. May take a couple of days but I'll review and merge as soon as I am able.

@dev-d dev-d closed this Mar 6, 2022
@dev-d dev-d reopened this Mar 6, 2022
@dev-d
Copy link
Author

dev-d commented Mar 6, 2022

(Oops closed and reopened the PR. I assumed I magically had write access to your repo 😂😬🤷‍♂️)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants