Reproducibility of builds

[Claudius Heine <claudius.heine.ext@siemens.com>]

Hi,

am I right that Isar supports or should support reproducible root file 
system build?

If I understand correctly, when multistrap is called, it fetches always 
the latest version of all packages from the debian repository mirrors. 
Am I mistaken or is this feature still on the roadmap?

I that is on the roadmap, how are you thinking of solving this issue?

The openembedded way would be to seperate the fetch and 'install' step 
and first download all packages into the DL_DIR and then use them from 
there. Maybe we could create this pipeline:

dpkg-binary Recipe:

fetch deb file into downloads -> insert into local repository

dpkg-source Recipe:

fetch sources into downloads -> build packages -> insert into local 
repository

image Recipe:

fetch all required packages into downloads -> insert all of them into 
the local repository -> create root fs using only the local repository

Multistrap provides a '--source-dir DIR' parameter, that stores all 
installed packages into a directory. So if we would use that as a 
fetcher, then we would create a temporary rootfs just to get all 
required packages for the project.

Are there other possible solutions for this?

Cheers,
Claudius