Re: [MirageOS-devel] Reproducible builds

[Richard Mortier <richard.mortier@xxxxxxxxxxxx>]

On 10 December 2015 at 16:00, Thomas Gazagnaire <thomas@xxxxxxxxxxxxxx> wrote:
>> Wondering if there may be anything to do on our end though, as well?
>> (Particularly perhaps with the various cross compilation things that
>> rump support probably entails.) eg., having the generated makefile
>> snap the hashes of all opam package used etc into some kind of
>> manifest perhaps?
>
> Functoria generates a manifest of the package versions and names used by the 
> build (look into Info_gen.ml I think). We could try to extend it to keep 
> track of some kind of SHAx as well, but the data is not really available in 
> opam's metadata (we only get the md5 of a tar.gz file, which is not really 
> ideal)
>

Ah right-- sounds like it could be a start though?

Is there any chance that OPAM might evolve toward this, Eg by
supporting SHAx of some sort rather than MD5, or that it would be
beneficial to just add MD5 of the package tarball downloaded by OPAM,
or something?


-- 
Richard Mortier
richard.mortier@xxxxxxxxxxxx

_______________________________________________
MirageOS-devel mailing list
MirageOS-devel@xxxxxxxxxxxxxxxxxxxx
http://lists.xenproject.org/cgi-bin/mailman/listinfo/mirageos-devel