Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make the build reproducible #2646

Closed
wants to merge 1 commit into
base: dev
from

Conversation

Projects
None yet
2 participants
@lamby
Copy link

lamby commented Mar 12, 2019

Whilst working on the Reproducible Builds effort, we noticed that vue-router could not be built reproducibly.

This is due to it embedding the current build year into the file headers. This has been replaced with using SOURCE_DATE_EPOCH where available. This was originally filed in Debian as #924378.

Make the build reproducible
Whilst working on the Reproducible Builds effort [0], we noticed
that vue-router could not be built reproducibly.

This is due to it embedding the current build year into the file
headers. This has been replaced with using SOURCE_DATE_EPOCH [1]
where available.

This was originally filed in Debian as #924378 [2].

 [0] https://reproducible-builds.org/
 [1] https://reproducible-builds.org/specs/source-date-epoch/
 [2] https://bugs.debian.org/924378
@posva

This comment has been minimized.

Copy link
Member

posva commented Mar 12, 2019

hey, I don't get this, in what situation current code isn't working?

@lamby

This comment has been minimized.

Copy link
Author

lamby commented Mar 13, 2019

hey, I don't get this, in what situation current code isn't working?

It builds differently depending on which year you happen to be building vue-router in. :)

@posva

This comment has been minimized.

Copy link
Member

posva commented Mar 13, 2019

yeah, that's the point, to write current year. In what situation is new Date().getFullYear() not working?

@lamby

This comment has been minimized.

Copy link
Author

lamby commented Mar 13, 2019

It's not that it "doesn't work", it is that it generates a different result depending on the year. This makes the build non-reproducible which is important for a variety of reasons - see the links in my original post! :)

@posva

This comment has been minimized.

Copy link
Member

posva commented Mar 13, 2019

I appreciate your concern but you are still not explaining things to me...
We want the year to be different based on when we run the script

@posva posva closed this Mar 13, 2019

@lamby

This comment has been minimized.

Copy link
Author

lamby commented Mar 13, 2019

I am not going into great depth here, but I would not want to bore you by explaining things here that you might have read elsewhere already… for example https://reproducible-builds.org/docs/buy-in/ etc.

@posva

This comment has been minimized.

Copy link
Member

posva commented Mar 13, 2019

It's the first time I've heard about reproducible builds and I have read just a bit with the links you sent me but I really don't see what attack this is preventing. I will rather see the opposite as it is using an env variable that doesn't seem to be standard in every unix os (it doesn't exist in osx). Maybe there is a problem for other languages or libraries but I don't see what is being prevented here, I just see the code becoming more complicated for no benefit. Don't worry about copy pasting things that I may know, I won't feel bothered or anything, I get your intentions seem good

@lamby

This comment has been minimized.

Copy link
Author

lamby commented Mar 13, 2019

Unfortunately my time is really stretched so you can imagine that I cannot spend 1 hour on each pull request explaining the background and justify the reasons behind reproducible builds. Perhaps you could spend a few moments reviewing some slides/presentations on our Resources page. Again, really sorry I cannot provide a custom justification to every single project...

@posva

This comment has been minimized.

Copy link
Member

posva commented Mar 13, 2019

It's okay, I understand

@lamby

This comment has been minimized.

Copy link
Author

lamby commented Mar 15, 2019

It's okay, I understand

Cool; fancy applying the patch in that case? :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.