Re:Go 1.18 will embed source version information into binaries
by capableweb on Wednesday October 27, 2021 @12:08PM
(#29015171)
> However, if I had to choose between knowing the exact commit and knowing the exact time, I'd certainly choose exact commit, no question. But you don't; you might as well just stick all the data in.
You don't have to choose between embedding the build time or commit information, but you do have to choose between embedding the build time or having reproducible builds. I know what I prefer, as a maintainer and consumer.
It's really nerve-wrecking (to me) when you pull down a binary from the website releases, pass it to sha256sum and gets something different than when you built the same commit from source. Usually that's because dates and times are embedded in the build, but sometimes stuff is just different depending on who built it, and that's scary.
You don't have to choose between embedding the build time or commit information, but you do have to choose between embedding the build time or having reproducible builds. I know what I prefer, as a maintainer and consumer.
It's really nerve-wrecking (to me) when you pull down a binary from the website releases, pass it to sha256sum and gets something different than when you built the same commit from source. Usually that's because dates and times are embedded in the build, but sometimes stuff is just different depending on who built it, and that's scary.