GitHub user parshimers added a comment to the discussion: Build reproducibility for automated release signing
OK, I looked a bit more at https://github.com/apache/texera/pull/8812 and I understand it somewhat now. The very clever solution Claude pulled out here is to use the ubuntu/debian snapshot archives, and date gating on PyPI, to basically guarantee a set of packages that go into one of our dockerfiles can be deterministic. I was thinking version pinning would be the way to go about this but apparently the packages can change sometimes even if the versions are the same. I think it needs some more manual testing though. I also still don't entirely get why none of the things I would have thought would be necessary for the Scala part of the build seem to be. I guess somehow we don't run into some of the usual things that make jars non-deterministic from source, but I still would like to fully understand how. GitHub link: https://github.com/apache/texera/discussions/8807#discussioncomment-18827136 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected]
