Show HN: Esy – fast and simple package management for native ReasonML/OCaml

Re:Show HN: Esy – fast and simple package management for nat... by Foxboron on Wednesday January 23, 2019 @07:12AM (#18977555)

I'm having a hard time figuring out if esy supports reproducable builds, and package signing+verfication.

And if reproducable builds are supported, what format is used to store the build information so downloaded packages can be reproduced.

[ Parent | on HN ]

Re:Show HN: Esy – fast and simple package management for nat... by andreypopp on Wednesday January 23, 2019 @07:24AM (#18977613)

esy tries hard to enable reproducible builds:

- esy builds are happening in an isolated environment with only specified dependencies available

- esy executes build processes under sandboxing (so builds can't write into arbitrary locations, we have some work to do here though)

- esy has feature which allows to rewrite binaries to remove prefix paths from them.

As for package signing+verification (assuming you are talking about source code) we do only integrity checks now for packages downloaded from npm and via opam.

EDIT: wording

[ Parent | on HN ]

Re:Show HN: Esy – fast and simple package management for nat... by Foxboron on Wednesday January 23, 2019 @08:57AM (#18978103)

And how is the build env recorded for timestamps and env variables? Is all of this standardized?

>we do only integrity checks now for packages downloaded from npm and via opam

Which is fine, but esy should be capable of accepting signatures and checking them against a given key.

[ Parent | on HN ]

Re:Show HN: Esy – fast and simple package management for nat... by andreypopp on Wednesday January 23, 2019 @09:23AM (#18978297)

> And how is the build env recorded for timestamps and env variables? Is all of this standardized?

We do record the build env now in esy's own format, you run:

    esy build-plan PKG

to see the build plan (a-la Nix derivation) which is a JSON with build commands and environment.

As regarding timestamps we don't set SOURCE_DATE_EPOCH yet but we definitely plan to address that.

[ Parent | on HN ]