Re:Simple Dockerfile examples are often broken by default
by michaelmior on Tuesday May 28, 2019 @02:33PM
(#20032957)
I think this depends on your definition of "reproducible build." If you're talking about builds being bit for bit identical, that might not be worthwhile given the complexities of doing so with most build tools. But if you mean the same versions being used for dependencies, then absolutely.
Re:Simple Dockerfile examples are often broken by default
by OJFord on Tuesday May 28, 2019 @02:36PM
(#20032985)
Yes, I agree completely, as replied to sibling:
https://news.ycombinator.com/item?id=20032980
Re:Simple Dockerfile examples are often broken by default
by verroq on Tuesday May 28, 2019 @02:29PM
(#20032912)
No not really, any tiny open source project isn’t worth the hassle of making a reproducible build for.
Re:Simple Dockerfile examples are often broken by default
by OJFord on Tuesday May 28, 2019 @02:35PM
(#20032980)
Well, I look at reproducible as a scale (and incidentally, with an increase in effort as you slide along it, too).
A certain amount of reproducibility - a container, pinned dependencies - gives such large reward for how easy it is to achieve that it absolutely is worth it for a tiny open source project.
Worrying about the possibility of unavailable package registries and revoked signing keys, on the other hand, probably isn't.
It's a trade-off. But you certainly don't need to be Google-scale for some of it to be very worth your while.
Any tiny open source project benefits from a reproducible build (when you come back to it months later) and also new versions (with fixed vulnerabilities, and compatibility with the new thing you're trying to do).