Skip to content
check opam package reproductibility
OCaml Makefile
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
src
.gitignore
.travis.yml
Makefile
README.md
orb.opam

README.md

orb: check opam package reproductibility

This tool can check if an opam package build is reproductible (cf. https://reproducible-builds.org). It installs the package twice (different path & time) and check that installed files have the same hash.

Install & use

$ opam pin git+https://github.com/rjbou/orb
$ orb pkg [--diiffoscope]

This project is currently in early beta.

How does it work?

orb uses an already installed opam & opam root, and it follows those steps:

  • Install of two new switches in /tmp
  • Install of packages dependencies
  • Install of required packages
  • Retrieves hashes of installed files and look for mismatches
  • Remove temporary switches

With option --diffoscope, mismatching files are copied locally and their diff generated, using diffoscope.

As orb generates temporary switches, packages dependencies are installed each time (also compiler), which can be time consuming when working on a package. Option --use-switches sw1,sw2 can be used to give reusable switches.

--keep-switches option permit to keep those generated switches for investigation needs. To manually remove them, don't just remove directory, but use opam switch remove <sw>.

You can’t perform that action at this time.