|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
lsedlar commented 6 years ago | ||
marmarek commented 6 years ago Yes, exactly. | ||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
This PR is a part of the “reproducible builds” effort 1.
The attached patches replaces timestamps with SOURCE_DATE_EPOCH2 variable (if set) to ensure reproducible result. Also .treeinfo file is made deterministic and genisoimage is replaced with xorriso which already support generating reproducible images.
The top-most commit depends on https://github.com/rpm-software-management/createrepo/pull/9. If you prefer, I can drop it from this PR and open new one when it gets merged.
To make the ISO image fully reproducible, similar changes are needed in lorax, but there are no direct dependencies between those two patch series.
With this all applied, pungi given the same set of input rpm packages (and build options + SOURCE_DATE_EPOCH variable) will build identical ISO image.
This is backwards compatible, right? If createrepo does not have the patch, it will be effectively a no-op?