On 4/4/19 11:25 AM, David A. Wheeler wrote: > The front page has this definition: > >> Reproducible builds are a set of software development practices >> that create an independently-verifiable path from source to binary >> code. > > The word "path" here is confusing. A "path" can be interpreted as > being a "process", so it sounds like the only requirement is that you > can rerun the *process*. But that's not enough to be reproducible - > you have to have identical *results*! That is not at all clear from > this definition. > > That front page links to a different definition: > >> A build is reproducible if given the same source code, build >> environment and build instructions, any party can recreate >> bit-by-bit identical copies of all specified artifacts. > > I like this definition much more; it is much less ambiguous. You > could add "(e.g., executables)." after "artifacts" if you think that > artifacts is too abstract. > > Can we simply copy this definition to the front page & use this > definition instead on https://reproducible-builds.org/ ? > > Sorry to (re)start a definition war, but when I came back to look at > the definition (while trying to explain it to someone else) I found > it led to more questions than answers.
What about switching from: Reproducible builds are a set of software development practices that create an independently-verifiable path from source to binary code. ([more](link target)) To: Reproducible builds are a set of software development practices that create an independently-verifiable, trusted path from source code to a specific binary artifact. Reproducible builds have many factors; for more details, see the [technical definition](link target). ... This clarifies that we care about reproducing a specific artifact, not just reproducing the creation of "an" artifact. Artifacts != executables and we should *not* lock ourselves into a corner over whether this only applies to something in the ELF/PE/Mach-O file formats. Also there can be lots of different executables for a project that do the same thing e.g. compiled by and for different distros, but "artifact" implies a lot more uniqueness. Then immediately further down the main page, we already have a section for "Why does it matter?", which can provide any additional clarification needed about the tagline. -- Eli Schwartz Arch Linux Bug Wrangler and Trusted User
signature.asc
Description: OpenPGP digital signature
_______________________________________________ [email protected] mailing list To change your subscription options, visit https://lists.reproducible-builds.org/listinfo/rb-general. To unsubscribe, send an email to [email protected].
