RPM builds are not reproducible

ctron / rpm-builder

Maven RPM builder plugin

https://ctron.github.io/rpm-builder

Eclipse Public License 2.0

56 stars 32 forks source link

RPM builds are not reproducible #60

Closed tisoft closed 2 years ago

tisoft commented 2 years ago

RPMs build by the rpm-builder are not reproducible.

Following issues have been found:

Dependency sorting is not stable, if two dependencies are equal in name and version, but differ in their flags, they are sorted differently each time, leading to a different RPM (Caused by https://github.com/eclipse/packager/issues/18, fixed by https://github.com/eclipse/packager/pull/19)
Inode numbers are not reproducible
timestamps can't be set

ctron commented 2 years ago

I think this makes sense. But so far, it wasn't a goal of the project.

It would be great if you could work on this, as my bandwidth on this is pretty limited at the moment. I would definitely try to help as good as I can.

tisoft commented 2 years ago

@ctron Already on it. 😄 #61