[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Reproducible installation images
From: |
Mark H Weaver |
Subject: |
Re: Reproducible installation images |
Date: |
Tue, 12 Dec 2017 17:25:04 -0500 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/25.3 (gnu/linux) |
address@hidden (Ludovic Courtès) writes:
> Mark H Weaver <address@hidden> skribis:
>
>> address@hidden (Ludovic Courtès) writes:
>>
>>> Mark H Weaver <address@hidden> skribis:
>>>
>>>> To enable independent verification of these installer images, it would
>>>> be helpful to include the precise commands needed to reproduce these
>>>> images, and the git commit to run them on.
>>>>
>>>> What do you think?
>>>
>>> The manual already gives those commands:
>>>
>>>
>>> https://www.gnu.org/software/guix/manual/html_node/Binary-Installation.html
>>> (bottom)
>>>
>>> https://www.gnu.org/software/guix/manual/html_node/Building-the-Installation-Image.html
>>
>> They give the commands, but they do not provide the git commit that you
>> ran these commands on.
>
> True. So the announcements could say something like:
>
> See the “Binary Installation” and “Building the Installation Image”
> sections of the manual on how to recreate these binary images. The
> ‘guix-binary’ tarballs were created from the ‘v0.14.0’ Git tag; the
> ‘guixsd-’ images were created from the tip of the ‘version-0.14.0’
> branch.
This looks good, except for the "tip of the ‘version-0.14.0’ branch"
reference, which may change over time. Ideally, the commit references
should be reliably immutable.
What do you think?
Mark