Re:Go 1.18 will embed source version information into binaries
by Steltek on Wednesday October 27, 2021 @11:51AM
(#29014923)
Isn't this only a concern for OSS projects where reproducibility is a concern? At my proprietary coding job, reproducibility is a nonstarter anyway and build time is super important for debugging day-to-day (or even minute to minute) problems.
[ Parent
| on HN ]
Re:Go 1.18 will embed source version information into binaries
by er4hn on Wednesday October 27, 2021 @12:15PM
(#29015280)
It's a concern for private industry as well.
The solarwinds and other recent supply chain attack involved injecting additional code into a build environment. Reproducible builds could have been done in multiple places as an auditing mechanism to catch this.
Another place where reproducible builds is useful in industry is being able to reproduce debug symbols for something after it has shipped. Sure you can rely on always saving debug symbols in an artifact repo, but if those age out and you get a customer case... what ya gonna do?