Request: Add ability to reproduce build including git revisions and other 3-rd party tool versions

[aleksas]

To comply with LGPL build being reproducible is important, so it would be helpful if there would be option to not just build or update according to media-autobuild_suite.ini but also reproduce the build with frozen revisions and tool versions.

[wiiaboo]

It's not the suite that needs to comply with LGPL, it's the people that redistribute binaries compiled using it.

But I agree it would be somewhat useful to centralize the VCS commit hashes/versions somewhere, maybe more useful than the changelog file. And patches need to be considered/gathered easily. If you apply git am patches it'll change the commit that goes into the compiled binary. If you apply patch patches it'll be a "dirty" build. Stuff like that.

There's no point in documenting msys dependencies as we have no control over them or what patches they use, so only document what we can, from dependencies built by the suite.

[1480c1]

I have been considering adding a functionality such as maybe something repo_hashes.txt to add in <reponame>=<hash> to checkout whatever is at <hash> instead of whatever the default is.

An alternative would be a json file that could contain options such as changing the url to pull, commit to checkout, and additional patches, similar to pacman's pkgbuild, but that would require a bit of time.

[1480c1]

Perhaps I can link the packages labeled with mingw on the readme with a link to their folder in msys2/MINGW-packages

[wiiaboo]

There's no guarantee that MINGW-packages matches absolutely what they use to build. They might not've built the most recent version of the package, or it might not exist in git anymore but still be available as a package.