Re: Idea for implementing reproducible builds

[Claudius Heine <claudius.heine.ext@siemens.com>]

Hi,

On 2018-05-22 15:47, Andreas Reichel wrote:
> On Tue, May 22, 2018 at 01:55:21PM +0200, [ext] Claudius Heine wrote:
>> Hi,
>>
>> I am still working on reproducible builds and here is my current idea to
>> solve this.
>>
>> Simple put: Mount the /var/cache/apt/archives of the images and buildchroot
>> to the isar-bootstrap root file system and then create a tarball of it. This
>> way we have a tarball of the build just after debootstrap + upgrade with the
>> one 'apt update' step done, but without any other changes to it and all used
>> packages already in the apt package cache.
>>
>> When restoring just skip most of the isar-bootstrap steps and extract the
>> tarball instead, since the packages are available in the package cache and
>> the package index is not updated it will use the packages from the cache.
>>
>> This way we would side step the obstacle to make debootstrap reproducible by
>> just using its product while the reset of the process can be redone by isar.
> "while the reset of the process can be redone by Isar."
> I think I did not understand that exactly :)

Thats a typo. Should be "while the rest of the process can be redone by 
Isar".

What I mean by that is that everything done by isar after the base 
isar-bootstrap file system is generated or everything that is 
independent for the isar-bootstrap file system will be done in the same 
way again. Only the generation of the isar-bootstrap is changed from 
using debootstrap + 'apt update' + 'apt upgrade' + config deployment to 
just extracting the tarball.

Claudius

-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-54 Fax: (+49)-8142-66989-80 Email: ch@denx.de