News for hackers. Stuff that matters.

A comment on Go 1.18 will embed source version information into binaries. Parent comment

Re:Go 1.18 will embed source version information into binaries by ashtonkem on Wednesday October 27, 2021 @10:38AM (#29013880)
Changes in the build pipeline won’t be encoded in the git sha, since usually those are stored separately. And if you pull in a non-reproducible library, time will matter a lot.

This of course could be fixed with a Nix type system (or even Nix itself), where the inputs of everything are hashed. But that’s a much more radical change than what OP is doing.

[ Parent | on HN ]
Re:Go 1.18 will embed source version information into binaries by capableweb on Wednesday October 27, 2021 @11:17AM (#29014441)
> Changes in the build pipeline won’t be encoded in the git sha, since usually those are stored separately.

Build pipelines should be versioned as well. Correlate the application sha with the pipeline sha and you have both sources.

> And if you pull in a non-reproducible library, time will matter a lot.

I'd argue that if your application is pulling in a non-reproducible library and using it, then your application won't be reproducible until you've made the libraries you're using also reproducible. Otherwise the entire idea falls apart.

[ Parent | on HN ]