Re: deduplicating noarch subpackages
On 2/13/20 11:26 AM, Nicolas Mailhot wrote:
Le jeudi 13 février 2020 à 09:59 -0800, Josh Stone a écrit :
>
> It's not so black and white. In theory, the only thing that should
> matter is the target triple, but the metadata also hashes the
> metadata
> of all its build dependencies. That in turn may include procedural
> macros (essentially compiler plugins) which are host binaries. The
> end
> result for the target should be the same, but it's a real concern for
> upstream that ignoring the host would break caching that relies on
> filename differences.
It is so black and white. If you can not produce bit-perfect identical
builds, don’t try to make the result noarch.
AIUI, there's no requirement that noarch has to be perfectly
reproducible -- Koji explicitly ignores file size and checksum.
Neither koji, nor auditors, nor other third parties, can be expected
to
check binary differences for you, and identify what differences matter
and what differences do not matter.
Neither koji, nor auditors, nor other third parties, can be expected to
trust that you did this checking for every single build that differs.
The *only* sane check strategy is a black and white equal/inequal test.
And you can not handwave those concerns aways because you feel your
builds should be noarch (feeling is not implementable in software).
I'm not waving it away. Believe it or not, I actually do understand the
impact here.
When you write
> it's a real concern for upstream that ignoring the host would break
> caching
you are writing that upstream thinks the result is archful (because if
it actually were noarch, it would be perfectly fine to substitute one
build output for another, and there would be no caching concerns).
If you read that upstream PR, you might understand my comment about
caching better, and see that I'm also trying to find a better solution
for those concerns.
The proof is in the pudding. noarch → binary differences do not
matter,
they can be removed during the build process, and koji will be happy.
archful → removing differences will break something.
And, removing differences does not necessarily mean removing things.
The reproducible build project didn’t remove timestamps. It just made
sure the same timestamp would be used for all builds.
Regards,