Skip to content

Conversation

@dev-d
Copy link

@dev-d dev-d commented Feb 10, 2022

This PR adds optional support for ensuring that two RPMs created from the same source code create the exact same byte-for-byte RPM output. See https://reproducible-builds.org/ for details on why such a feature has value.

The only change that is needed in Redline to support this is to provide an override where the "Date Built" can be overridden by an environment variable.

The environment variable chosen follows the spec defined at https://reproducible-builds.org/docs/source-date-epoch/ . Therefore, you can override the default built date with the env variable SOURCE_DATE_EPOCH

A unit test is added to verify this new behavior by injecting a test environment variable.

If this PR is accepted, we may list this library to https://reproducible-builds.org/docs/jvm/

Limitations:

  • Redline will still create different RPMs if the order in which files are added into the Builder are changed. However, that is not something that changes when redline is executed on different environments.
  • Make sure that the binaries that you package using Redline themselves are reproducible builds.

@craigwblake
Copy link
Owner

Thanks for the contribution. May take a couple of days but I'll review and merge as soon as I am able.

@dev-d dev-d closed this Mar 6, 2022
@dev-d dev-d reopened this Mar 6, 2022
@dev-d
Copy link
Author

dev-d commented Mar 6, 2022

(Oops closed and reopened the PR. I assumed I magically had write access to your repo 😂😬🤷‍♂️)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants