The digest of the windows installer is not stable

elves / elvish

Powerful scripting language & versatile interactive shell

https://elv.sh/

BSD 2-Clause "Simplified" License

5.53k stars 297 forks source link

The digest of the windows installer is not stable #1722

Closed da-liii closed 5 months ago

da-liii commented 10 months ago

See https://github.com/ScoopInstaller/Main/commits/master/bucket/elvish.json

Why?

xiaq commented 10 months ago

Huh. dl.elv.sh is geo-balanced to one of two nodes that build binaries independently, and it turns out that zip files includes timestamps so they are not reproducible by default. The exe files are identical though

https://cdg.dl.elv.sh/windows-amd64/elvish-v0.19.2.exe.sha256sum
https://hkg.dl.elv.sh/windows-amd64/elvish-v0.19.2.exe.sha256sum

Still looking into the best way to get reproducible zip files.

xiaq commented 10 months ago

I've manually copied the 0.19.2 zip files and their sha256 sum files from the cdg node to the hkg node. I'll fix the reproducibility problem later.