Hi, Sorry if my email came as a little crass. Some of my frustration with bureaucracy at my university poured through into the words on that email.
Comments inline. > I'm just trying to figure out how to rebuild Maven Central content in a way > that has a chance to get the same binary result, starting on a few simple > examples done by hand = a few projects, in all their past versions. > > Figuring out the command to run is one aspect. > But I'm also trying to figure out which build environment I must use for each > version of each project: this is where it is tricky. That's the argument that I'd like to make: in-toto supports environment information out of the box (i.e., you can populate anything you want). Verification uses a tolerant reader pattern, that provides a minimum set if security properties (i.e., bit-by-bit correspondence between all involved artifacts and pipeline step integrity). You can add more to it by means of inspection commands (e.g., you can match the LICENSE shipped in the package with one in the upstream repository). If you'd like to add any arbitrary information into the "environment" field of an attestation you can do so. > If you think in-toto can help, don't hesitate to show how: I read the site > and > could not see what I could get from it, be it at the current step > (discovering > how to write the rebuild instructions for a human) or later when trying to > automate and extend I can take a look at the repository again (I mostly just took a look at the readme earlier). What I was considering is that in-toto can produce snapshots of the execution in the maven lifecycle (maybe as means as a plugin). I also understand that the plan later down the line is to share attestations of these builds. I'm imagining that building a mvn plugin shouldn't be hard (in the same way that a Jenkins plugin was built) to output an attestation with all the information needed to bootstrap a reproducible environment (and the added benefit of it being signed. Thanks, -Santiago.
signature.asc
Description: PGP signature
_______________________________________________ [email protected] mailing list To change your subscription options, visit https://lists.reproducible-builds.org/listinfo/rb-general. To unsubscribe, send an email to [email protected].
