X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:content-type:mime-version:subject:from
	:in-reply-to:date:content-transfer-encoding:message-id
	:references:to; q=dns; s=default; b=jyIgNLC7ILr4WK4SO8luW3cvsPHp
	4Px/RwHO8vwotfKbv85emfMAYduf/QutF50ELcOeEJbrEr89bzFtybkATdh0h9sl
	dpBXxdEYmb7L7fyNxpPibhfw1/An6Mp2viUSdVKVp0P9YDCjHKXGHavBn6lJHgyy
	f6jUAgR76tP0eEs=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:content-type:mime-version:subject:from
	:in-reply-to:date:content-transfer-encoding:message-id
	:references:to; s=default; bh=EmyBxbGrcEbyuObFeSoILgP3RuE=; b=cl
	J/QJD5JRdNw7ABdldYUuqjJtlTpWuQuCbDbSXQMeNIawklrAwhBn8Tk0GABvciJc
	ZdUmE7O2ZXz1mbq8ayZoEnpoHqghOZXYf4uu2fFQe4PSm+O1rFORNZDfwe/TcZTT
	EaeQ7PLwUOBxYMjJV5zEzUAkIl7wHg/z8BpMQDJv4=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=0.5 required=5.0 tests=AWL,BAYES_40,KAM_LAZY_DOMAIN_SECURITY,RP_MATCHES_RCVD autolearn=ham version=3.3.2 spammy=and, H*r:qmail-ldap-1.03, yum, H*i:sk:c69da50
X-HELO: etr-usa.com
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
Subject: Re: Deterministic builds
From: Warren Young <wyml AT etr-usa DOT com>
In-Reply-To: <c69da505-542a-0256-46d9-f35a379c3443@cornell.edu>
Date: Thu, 5 May 2016 14:26:35 -0600
Message-Id: <AC9BB4BE-DE9D-4AC3-8FB3-7B0E58851F03@etr-usa.com>
References: <ff5f5b20-33e2-ef2d-012a-a9e02903ba21 AT cornell DOT edu> <CAFo71_4uBbNZ6JakbNE3mJ3HgvFRnFa-dK+GSrNdpmds1iXzow AT mail DOT gmail DOT com> <258af4b4-e1f0-171c-4b94-772603038fde AT cornell DOT edu> <c69da505-542a-0256-46d9-f35a379c3443 AT cornell DOT edu>
To: The Cygwin Mailing List <cygwin AT cygwin DOT com>
X-IsSubscribed: yes
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by delorie.com id u45KR7xg010166

On May 5, 2016, at 11:59 AM, Ken Brown <kbrown AT cornell DOT edu> wrote:
> 
> Ismail's suggestion did indeed produce deterministic builds in my setup.  I built a large project with about 150 executables, changed a few source files, removed the build directory, rebuilt, and found that only the (expected) few executables changed.

…and does it do the same on a very different system?  e.g. Try it on both 64-bit Windows 10 and on 32-bit Windows 7.

Perhaps you don’t need it, but part of the reason for the big push recently for reproducible builds is to be able to verify that binaries from a given source (e.g. Red Hat’s RPM feed) are in fact buildable from the sources distributed from the same source (e.g. Red Hat’s SRPMs).

The usual motivation for that is security: it’s no good receiving an SRPM with a security patch if the binary that yum installs still has the bug.

Therefore, if you get “reproducible” builds on only a single machine, you may not have achieved any useful result.
--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple