ericcornelissen/js-regex-security-scanner

Reproducible builds

ericcornelissen opened this issue · 1 comments

ericcornelissen commented

Summary

The concept of a reproducible build aims to provide some guarantees on the relation between source and output artifact, namely that building from the same source twice always results in the same output artifact. For this project that roughly means that the container image resulting from make build is reproducible.

The goal of this issue is to

  1. Determine if the build is reproducible and under what constraints (e.g. target architecture)
    A. If it's not reproducible, fix that
  2. Implement a test in order to continuously verify the build is reproducible
ericcornelissen commented

An initial check for this could be implemented based on https://github.com/reproducible-containers/diffoci, see also ericcornelissen/ades#280