From mboxrd@z Thu Jan 1 00:00:00 1970 X-GM-THRID: 6449958519840964608 X-Received: by 10.25.23.36 with SMTP id n36mr158201lfi.39.1501747993630; Thu, 03 Aug 2017 01:13:13 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com Received: by 10.46.70.1 with SMTP id t1ls58059lja.1.gmail; Thu, 03 Aug 2017 01:13:13 -0700 (PDT) X-Received: by 10.25.92.87 with SMTP id q84mr130515lfb.43.1501747993059; Thu, 03 Aug 2017 01:13:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1501747993; cv=none; d=google.com; s=arc-20160816; b=FHKRC0sodCTeFCDBfqlxAX4A+tjPV4Ru5bhokkx9zTef3Uow2PTzwH+UfgcVus2MUK 4Uuo6NoNssDkgzWKHAXiLR/r0EgfSRONWA2L2iz40U3PkLPK9m+Dga7mMRKm7U+BEyZc BtVEMjs/Jv2CGVpjK26f0ewsK6+VJQTU+zcCnlA3Ib1FeRCDqCcrpnikl9jpW54prI05 FWqQIwsdR81gd2C7ONp5OSCD5J+nccHUttvxNXgc69mX3LLi4xDKbtTcAqCFuBVnEt49 6BHH4KJviRUZg2Eg2wuBnwSE0yJ2Jc2GrTC1Z4O33lkPpyJxcMoXTT4CstRvOkjTBpfm YMqg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:content-language:mime-version:user-agent :date:message-id:subject:from:to:arc-authentication-results; bh=AJw94Yy3ExO6US6gqxEJR946ep/2yUPpxRmWH4uqYto=; b=H72DurzDl/QucNS6SwlhzMrGU8xiciQoPpon7TKELH6QQ7pAkF2oQzfU6eVc9/SXJ4 texHNDo4CiQGPe7rG7lu3G6OV98tYaee8OvLbala1At+aSP2I5KVeZoQvwAYpfLiymwt NoJBKqfQWKoW7al2eh64L3zKGnx7vLdFh6ydSE13TOLT8PWa0PPAoHs0wJXGXsZDgxPT 8CZj06ddfj1IbHYObKnl+PFR/zRfo7Ww8l20hejyGU1cIW1n3NUztmotbK4OEEB1IClh G5FE0IE4sQkKdelNW6IgLt1ISbqUyfs8qtZB9+YghtCSv/Wdum9Gfy22hhnnWIb86ftp tm2Q== ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=neutral (google.com: 192.35.17.14 is neither permitted nor denied by best guess record for domain of claudius.heine.ext@siemens.com) smtp.mailfrom=claudius.heine.ext@siemens.com Return-Path: Received: from david.siemens.de (david.siemens.de. [192.35.17.14]) by gmr-mx.google.com with ESMTPS id x7si565606wmf.8.2017.08.03.01.13.12 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 03 Aug 2017 01:13:13 -0700 (PDT) Received-SPF: neutral (google.com: 192.35.17.14 is neither permitted nor denied by best guess record for domain of claudius.heine.ext@siemens.com) client-ip=192.35.17.14; Authentication-Results: gmr-mx.google.com; spf=neutral (google.com: 192.35.17.14 is neither permitted nor denied by best guess record for domain of claudius.heine.ext@siemens.com) smtp.mailfrom=claudius.heine.ext@siemens.com Received: from mail1.sbs.de (mail1.sbs.de [192.129.41.35]) by david.siemens.de (8.15.2/8.15.2) with ESMTPS id v738DCDu020018 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 3 Aug 2017 10:13:12 +0200 Received: from [139.25.68.223] (linux-ses-ext02.ppmd.siemens.net [139.25.68.223]) by mail1.sbs.de (8.15.2/8.15.2) with ESMTP id v738DCbt012967 for ; Thu, 3 Aug 2017 10:13:12 +0200 To: isar-users@googlegroups.com From: Claudius Heine Subject: Reproducibility of builds Message-ID: Date: Thu, 3 Aug 2017 10:13:12 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-TUID: 0oa2oJMEQsgg Hi, am I right that Isar supports or should support reproducible root file system build? If I understand correctly, when multistrap is called, it fetches always the latest version of all packages from the debian repository mirrors. Am I mistaken or is this feature still on the roadmap? I that is on the roadmap, how are you thinking of solving this issue? The openembedded way would be to seperate the fetch and 'install' step and first download all packages into the DL_DIR and then use them from there. Maybe we could create this pipeline: dpkg-binary Recipe: fetch deb file into downloads -> insert into local repository dpkg-source Recipe: fetch sources into downloads -> build packages -> insert into local repository image Recipe: fetch all required packages into downloads -> insert all of them into the local repository -> create root fs using only the local repository Multistrap provides a '--source-dir DIR' parameter, that stores all installed packages into a directory. So if we would use that as a fetcher, then we would create a temporary rootfs just to get all required packages for the project. Are there other possible solutions for this? Cheers, Claudius