Reproducibilty considerations and tweaks
Closed this issue · 2 comments
hannesm commented
from #164, we suffer a bit that
- the ubuntu docker container is not reproducible per-se
- we use
apt updateleading to a random set of installed packages
To solve these issue, thanks to @h01ger we have some improvements (that should be done to (a) build-with-docker.sh and (b) builds.robur.coop):
- use a reproducible (debian) container from https://hub.docker.com/_/debian
- use a package snapshot (e.g. http://snapshot.notset.fr/archive/debian/20220523T033231Z/ instead of https://deb.debian.org/ for your apt sources.list) NB: snapshot.notset.fr will soon (tm) also be available as under snapshot.reproducible-builds.org but we are not there yet
hannesm commented
We could as well use orb in the GitHub action runner and collect/upload the build information.