Skip to content

Adding support for reproducible builds.#163

Open
dev-d wants to merge 2 commits into
craigwblake:masterfrom
dev-d:master
Open

Adding support for reproducible builds.#163
dev-d wants to merge 2 commits into
craigwblake:masterfrom
dev-d:master

Conversation

@dev-d

@dev-d dev-d commented Feb 10, 2022

Copy link
Copy Markdown

This PR adds optional support for ensuring that two RPMs created from the same source code create the exact same byte-for-byte RPM output. See https://reproducible-builds.org/ for details on why such a feature has value.

The only change that is needed in Redline to support this is to provide an override where the "Date Built" can be overridden by an environment variable.

The environment variable chosen follows the spec defined at https://reproducible-builds.org/docs/source-date-epoch/ . Therefore, you can override the default built date with the env variable SOURCE_DATE_EPOCH

A unit test is added to verify this new behavior by injecting a test environment variable.

If this PR is accepted, we may list this library to https://reproducible-builds.org/docs/jvm/

Limitations:

  • Redline will still create different RPMs if the order in which files are added into the Builder are changed. However, that is not something that changes when redline is executed on different environments.
  • Make sure that the binaries that you package using Redline themselves are reproducible builds.

@craigwblake

Copy link
Copy Markdown
Owner

Thanks for the contribution. May take a couple of days but I'll review and merge as soon as I am able.

@dev-d dev-d closed this Mar 6, 2022
@dev-d dev-d reopened this Mar 6, 2022
@dev-d

dev-d commented Mar 6, 2022

Copy link
Copy Markdown
Author

(Oops closed and reopened the PR. I assumed I magically had write access to your repo 😂😬🤷‍♂️)

@dev-d

dev-d commented Jul 12, 2026

Copy link
Copy Markdown
Author

@craig-openlaw hi there. Was wondering if you could merge this PR. Seems you had approved this a while back

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants