On Thu, Jul 11, 2019 at 05:54:51PM +0000, Matt Bearup via rb-general wrote: > Hello all,
Yo! > I'm experimenting with reproducible builds and, while I've managed to generate > several packages with correct hashsums (per reproducible-builds.org), there > are ~9 packages where I consistently get a different checksum. Focusing on > one package for this discussion... > > [...] > * However, I've tried multiple build tools (pbuilder and sbuild), multiple > build machines, and multiple host OSes (Stretch and Buster - though the > chroot is always buster). I *consistently* get a different sha256 checksum > for this package: > bbde6cee1fd915e5257b7c47977d8e88dc5e45816fe241fd8751a50aea98c6b8. None of these (pbuild and sbuild) recreate the environment with a BUILDINFO file necessary to recreate the hash. You can try using srebuild and see if it manages to produce the same hash as it would utilize the BUILDINFO to recreate the build environment. But this isn't a standalone tool yet. https://salsa.debian.org/reproducible-builds/debian-rebuilder-setup/blob/master/builder/srebuild -- Morten Linderud PGP: 9C02FF419FECBE16
signature.asc
Description: PGP signature
_______________________________________________ [email protected] mailing list To change your subscription options, visit https://lists.reproducible-builds.org/listinfo/rb-general. To unsubscribe, send an email to [email protected].
