Re: RFC: Check for reproducible builds.

[ericonr <ericonr@users.noreply.github.com>]

[-- Attachment #1: Type: text/plain, Size: 1417 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/pull/30588#issuecomment-830256754

Comment:
So, thinking about this.

- the current version of this PR won't almost ever have matched checksums, because of `source-revisions`; we would have to work around that if we want to go with this path
- very few people build packages locally with debug symbols, and `compile with debug + strip` is different from `compile without debug`, so anyone updating templates will need to consider it
- void doesn't have a package archive, nor do we have `BUILDINFO`. While `source-revisions` provides the git repo state (hooks and build styles), and, therefore, the version of all the packages listed in the template in `(host)makedepends`, it doesn't record the version of the dependencies of the packages listed in `(host)makedepends`. Specifying a `BUILDINFO` file to record that information would be necessary. The archive would be necessary to have somewhere to fetch the specific versions of packages from

The current vision of `reproducible-builds` usually means trying to have the same build environment to see if the package is deterministic. If we want to study what packages are "reproducible" when built with different dependencies and etc (remembering that even line numbers in headers can change debug info), I think we would have to call this effort something else.