redline icon indicating copy to clipboard operation
redline copied to clipboard

Adding support for reproducible builds.

Open dev-d opened this issue 3 years ago • 2 comments

This PR adds optional support for ensuring that two RPMs created from the same source code create the exact same byte-for-byte RPM output. See https://reproducible-builds.org/ for details on why such a feature has value.

The only change that is needed in Redline to support this is to provide an override where the "Date Built" can be overridden by an environment variable.

The environment variable chosen follows the spec defined at https://reproducible-builds.org/docs/source-date-epoch/ . Therefore, you can override the default built date with the env variable SOURCE_DATE_EPOCH

A unit test is added to verify this new behavior by injecting a test environment variable.

If this PR is accepted, we may list this library to https://reproducible-builds.org/docs/jvm/

Limitations:

  • Redline will still create different RPMs if the order in which files are added into the Builder are changed. However, that is not something that changes when redline is executed on different environments.
  • Make sure that the binaries that you package using Redline themselves are reproducible builds.

dev-d avatar Feb 10 '22 20:02 dev-d

Thanks for the contribution. May take a couple of days but I'll review and merge as soon as I am able.

craigwblake avatar Feb 11 '22 18:02 craigwblake

(Oops closed and reopened the PR. I assumed I magically had write access to your repo 😂😬🤷‍♂️)

dev-d avatar Mar 06 '22 05:03 dev-d