News for hackers. Stuff that matters.

A comment on From xz to ibus: more questionable tarballs. Parent comment

Re:From xz to ibus: more questionable tarballs by weinzierl on Tuesday April 02, 2024 @06:53AM (#39904318)
"The xz incident became a wake-up call that the Reproducible Build movement focused on binary reproducibility, but have so far ignored tarball reproducibility."

The reproducibility must stretch over all the outputs.

A related idea is the Hermetic Build", where the sameness of all the input is ensured, even including the build tools.

[ Parent | on HN ]
Re:From xz to ibus: more questionable tarballs by yencabulator on Tuesday April 02, 2024 @12:55PM (#39907991)
In this case, inputs, or more like the whole chain toward "real inputs".

A project can be reproducible when built from the release tarball, without being able to reproduce the release tarball from a git tag.

[ Parent | on HN ]