Closed ctaggart closed 5 years ago
NuGet 4.9 enabled repeatable package restores using a lock file. A sha512 of the content is used so a nuget package returns the same hash before it is signed and after. Unfortunately, the contentHash is giving different results on different platforms. and nuget packages with the same version, but different sdk versions are resulting in different contentHash values.
Working lock files are required to have deterministic builds. I'd really like to see deterministic builds become common in our .NET community. I would also like to see these contributions reviewed and merged:
NuGet: allow creating deterministic packages https://github.com/NuGet/NuGet.Client/pull/2775
Add support for --pathmap https://github.com/Microsoft/visualfsharp/pull/5801
add deterministic to msbuild targets https://github.com/Microsoft/visualfsharp/pull/6363
This wasn't super easy. A summary is in https://github.com/NuGet/Home/issues/7921#issuecomment-478152479
NuGet 4.9 enabled repeatable package restores using a lock file. A sha512 of the content is used so a nuget package returns the same hash before it is signed and after. Unfortunately, the contentHash is giving different results on different platforms. and nuget packages with the same version, but different sdk versions are resulting in different contentHash values.
Working lock files are required to have deterministic builds. I'd really like to see deterministic builds become common in our .NET community. I would also like to see these contributions reviewed and merged:
NuGet: allow creating deterministic packages https://github.com/NuGet/NuGet.Client/pull/2775
Add support for --pathmap https://github.com/Microsoft/visualfsharp/pull/5801
add deterministic to msbuild targets https://github.com/Microsoft/visualfsharp/pull/6363