Pass SOURCE_DATE_EPOCH to docker run #128
Conversation
See rubygems/rubygems#2289, it helps make gem builds reproducible
|
Ah I think |
|
I've added a test and included it in the sudoers allowlist. |
|
@segiddins Assuming this goes green, can you suggest some documentation improvements to help gem maintainers use this feature? |
|
Hmm. It's not something that's necessary for folks to use while building, but it is a pre-requisite to be able to rebuild a gem (because of timestamps in the tarball, which RubyGems will take from SOURCE_DATE_EPOCH, and also timestamps in the linked binary, and |
|
@segiddins Sorry, I'm not sure I understand your last response. Who is this feature for, what will they do with it, how will they use it? I think this is necessary both for user documentation but also so that I understand why this code is there as the maintainer. |
|
@flavorjones This shouldn’t be a feature that users really need to know about, but it’s a key tenant of reproducible builds.. Certain OS, like nix, mandate its usage. |
|
It still needs to be documented and I'd like at least for someone to verify that this works as expected. |
|
My point here really is that we don't know if the feature actually works to generate reproducible gems. I wrote a test that the env var gets exported. And I know what the env var does. But does the whole stack work? If nobody is willing to try it out and tell me it works, and explain how to build gems with it, it doesn't seem worth merging right now. |
|
Running after So setting the source date epoch is enough (for a simple gem) to get a byte-for-byte identical build out of |
|
@segiddins Great! Thank you for exercising the stack. I realize I must now be completely annoying you, but I feel you're missing an opportunity to educate people on what reproducible builds are and how to use this tool as part of that build chain by not adding something to the README. 🤷 But I'll stop asking and merge the feature, undocumented. If you decide in the future that you want to add something to the README, even if it's a link pointing to something you (or someone else) has written, I would gladly merge it. |
|
I agree it's a great idea to document reproducible gem builds 😅 cc @duckinator, we should do that for the |
|
Yeah, definitely. It's not proper documentation, but there's a very rough WIP tutorial about it at https://pup-e.com/resources/reproducible-gem-builds/. It doesn't discuss the inner workings at all, just the user-facing parts, but it should be enough to try it out. |
See rubygems/rubygems#2289, it helps make gem builds reproducible