Please fix reproducibility of Android build (wheel not pinned sufficiently?)
#7640
Comments
SomberNight
changed the title
wheel not pinned sufficiently?)
|
Thanks for the report.
However, it looks like pip install yarl |
SomberNight
added a commit
to SomberNight/electrum
that referenced
this issue
Jan 21, 2022
maybe fixes spesmilo#7640 Looks like by default pip is ignoring the locally available setuptools and wheel, and downloading the latest ones from the internet at build time... https://pip.pypa.io/en/stable/reference/build-system/pyproject-toml/?highlight=no-build-isolation#disabling-build-isolation https://stackoverflow.com/a/62889268 > When making build requirements available, pip does so in an isolated environment. That is, pip does not install those requirements into the user’s site-packages, but rather installs them in a temporary directory which it adds to the user’s sys.path for the duration of the build. This ensures that build requirements are handled independently of the user’s runtime environment. For example, a project that needs a recent version of setuptools to build can still be installed, even if the user has an older version installed (and without silently replacing that version). > > In certain cases, projects (or redistributors) may have workflows that explicitly manage the build environment. For such workflows, build isolation can be problematic. If this is the case, pip provides a --no-build-isolation flag to disable build isolation. Users supplying this flag are responsible for ensuring the build environment is managed appropriately (including ensuring that all required build dependencies are installed).
SomberNight
added a commit
to SomberNight/electrum
that referenced
this issue
Jan 21, 2022
maybe fixes spesmilo#7640 Looks like by default pip is ignoring the locally available setuptools and wheel, and downloading the latest ones from the internet at build time... https://pip.pypa.io/en/stable/reference/build-system/pyproject-toml/?highlight=no-build-isolation#disabling-build-isolation https://stackoverflow.com/a/62889268 > When making build requirements available, pip does so in an isolated environment. That is, pip does not install those requirements into the user’s site-packages, but rather installs them in a temporary directory which it adds to the user’s sys.path for the duration of the build. This ensures that build requirements are handled independently of the user’s runtime environment. For example, a project that needs a recent version of setuptools to build can still be installed, even if the user has an older version installed (and without silently replacing that version). > > In certain cases, projects (or redistributors) may have workflows that explicitly manage the build environment. For such workflows, build isolation can be problematic. If this is the case, pip provides a --no-build-isolation flag to disable build isolation. Users supplying this flag are responsible for ensuring the build environment is managed appropriately (including ensuring that all required build dependencies are installed). If only it were that easy! However, if we add the "--no-build-isolation" flag, it becomes our responsibility to install *all* build time deps, hence we now have "requirements-build-makepackages.txt".
SomberNight
added a commit
to SomberNight/electrum
that referenced
this issue
Jan 21, 2022
maybe fixes spesmilo#7640 Looks like by default pip is ignoring the locally available setuptools and wheel, and downloading the latest ones from the internet at build time... https://pip.pypa.io/en/stable/reference/build-system/pyproject-toml/?highlight=no-build-isolation#disabling-build-isolation https://stackoverflow.com/a/62889268 > When making build requirements available, pip does so in an isolated environment. That is, pip does not install those requirements into the user’s site-packages, but rather installs them in a temporary directory which it adds to the user’s sys.path for the duration of the build. This ensures that build requirements are handled independently of the user’s runtime environment. For example, a project that needs a recent version of setuptools to build can still be installed, even if the user has an older version installed (and without silently replacing that version). > > In certain cases, projects (or redistributors) may have workflows that explicitly manage the build environment. For such workflows, build isolation can be problematic. If this is the case, pip provides a --no-build-isolation flag to disable build isolation. Users supplying this flag are responsible for ensuring the build environment is managed appropriately (including ensuring that all required build dependencies are installed). If only it were that easy! However, if we add the "--no-build-isolation" flag, it becomes our responsibility to install *all* build time deps, hence we now have "requirements-build-makepackages.txt".
SomberNight
added a commit
to SomberNight/electrum
that referenced
this issue
Jan 22, 2022
maybe fixes spesmilo#7640 Looks like by default pip is ignoring the locally available setuptools and wheel, and downloading the latest ones from the internet at build time... https://pip.pypa.io/en/stable/reference/build-system/pyproject-toml/?highlight=no-build-isolation#disabling-build-isolation https://stackoverflow.com/a/62889268 > When making build requirements available, pip does so in an isolated environment. That is, pip does not install those requirements into the user’s site-packages, but rather installs them in a temporary directory which it adds to the user’s sys.path for the duration of the build. This ensures that build requirements are handled independently of the user’s runtime environment. For example, a project that needs a recent version of setuptools to build can still be installed, even if the user has an older version installed (and without silently replacing that version). > > In certain cases, projects (or redistributors) may have workflows that explicitly manage the build environment. For such workflows, build isolation can be problematic. If this is the case, pip provides a --no-build-isolation flag to disable build isolation. Users supplying this flag are responsible for ensuring the build environment is managed appropriately (including ensuring that all required build dependencies are installed). If only it were that easy! However, if we add the "--no-build-isolation" flag, it becomes our responsibility to install *all* build time deps, hence we now have "requirements-build-makepackages.txt".
|
I think 8559d1e should fix it. It cannot be used to rebuild 4.1.5 though, as the build flag has other consequences, so 4.1.5+cherry-picked-commit has lots of minor differences compared to official 4.1.5 binary. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Trying to reproduce Android version 4.1.5.0 file hash 3b5011c575ba0646855f8686e7952fe3a4da70ca009082dd6a683bc12de529ca I got an unexpected diff in
assets/private.mp3anddiffoscoperevealed it was due to the version ofbdist_wheel(0.36.2 vs. 0.37.1). Please pin this tool's version to keep reproducibility.Full report on WalletScrutiny.
The text was updated successfully, but these errors were encountered: