redline
redline copied to clipboard
Adding support for reproducible builds.
This PR adds optional support for ensuring that two RPMs created from the same source code create the exact same byte-for-byte RPM output. See https://reproducible-builds.org/ for details on why such a feature has value.
The only change that is needed in Redline to support this is to provide an override where the "Date Built" can be overridden by an environment variable.
The environment variable chosen follows the spec defined at https://reproducible-builds.org/docs/source-date-epoch/ . Therefore, you can override the default built date with the env variable SOURCE_DATE_EPOCH
A unit test is added to verify this new behavior by injecting a test environment variable.
If this PR is accepted, we may list this library to https://reproducible-builds.org/docs/jvm/
Limitations:
- Redline will still create different RPMs if the order in which files are added into the Builder are changed. However, that is not something that changes when redline is executed on different environments.
- Make sure that the binaries that you package using Redline themselves are reproducible builds.
Thanks for the contribution. May take a couple of days but I'll review and merge as soon as I am able.
(Oops closed and reopened the PR. I assumed I magically had write access to your repo 😂😬🤷♂️)