Re:Go 1.18 will embed source version information into binaries
by WJW on Wednesday October 27, 2021 @06:38AM
(#29011448)
It seems that a proper reproducible build checker should omit this kind of metadata from the portions of an executable that it verifies to be the same.
[ Parent
| on HN ]
Re:Go 1.18 will embed source version information into binaries
by smitop on Wednesday October 27, 2021 @06:47AM
(#29011505)
It's hard to statically determine what parts of an executable affect the running of it. Many executable have timestamps in them that do affect how they run, so you can't just ignore all timestamps if you want reproducible builds. See https://reproducible-builds.org/docs/timestamps/
Re:Go 1.18 will embed source version information into binaries
by verytrivial on Wednesday October 27, 2021 @06:46AM
(#29011501)
Proper does not mean an endless list of exceptions to deal with the endless number of ways to exclude effectively random, non-functionally relevant information in the binaries.
Because that where reproducible builds started.
Projects not interested in reproducibility can/should content themselves to live in the non-reproducible set instead of expecting someone else to monkey patch for them!
Re:Go 1.18 will embed source version information into binaries
by akavel on Wednesday October 27, 2021 @06:50AM
(#29011516)
Will 2 binaries differing by timestamp hash the same? do you suggest that file hashing algorithms skip date bytes in a binary? The KISS solution is to not vary date in the binary.
Re:Go 1.18 will embed source version information into binaries
by capableweb on Wednesday October 27, 2021 @07:26AM
(#29011762)
Not sure why the timestamp of when the build happened should even be logged. Include the git repository, the sha and if on CI, the build number/hash and you're pretty much covered.