Stable order for inputs
If building your software requires processing several inputs at once, make sure the order is stable across builds.
A typical example is creating an archive from the content of a directory. Most filesystems do not guarantee that listing files in a directory will always result in the same order.
Example Makefile
The following Makefile
will result in unreproducible
builds1:
Solutions:
a) List all inputs explicitly and ensure they will be processed in that order.
b) Sort inputs:
Watch out for locale-related issues
When sorting inputs, one must ensure that the sorting order is not affected by the system locale settings. Some locales will not distinguish between uppercase and lowercase characters.
For example, tar
will by default use the filesystem order when
descending directories:
A solution is to use find
and sort
but the following might still
have differences when run under different locales:
The locale used to sort files must be specified to avoid any surprises:
This might not be the only change required for Tar and other archive formats as they usually embed more metadata problems.
Introduction
- Which problems do Reproducible Builds Solve?
- Definitions
- History
- Why reproducible builds?
- Making plans
- Academic publications
Achieve deterministic builds
- Commandments of reproducible builds
- Variations in the build environment
- SOURCE_DATE_EPOCH
- Deterministic build systems
- Volatile inputs can disappear
- Stable order for inputs
- Stripping of unreproducible information
- Value initialization
- Version information
- Timestamps
- Timezones
- Locales
- Archive metadata
- Stable order for outputs
- Randomness
- Build path
- System images
- JVM
Define a build environment
- What's in a build environment?
- Recording the build environment
- Definition strategies
- Proprietary operating systems