ryan77627/guix
1
0
Fork 0
mirror of https://git.in.rschanz.org/ryan77627/guix.git synced 2024-12-25 22:08:16 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

build: Make outputs of node-build-system reproducible.

Browse source 
package.json records two hashes of package.tgz, which change for each
build, resulting in non-reproducible builds.

* guix/build/node-build-system.scm (repack): Add reproducibility options
to tar command.
This commit is contained in:
Lars-Dominik Braun 2021-06-17 14:11:19 +02:00
parent 16abea6ff1
commit 9c93573d15
No known key found for this signature in database
GPG key ID: F663943E08D8092A
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
guix/build/node-build-system.scm
View file

@ -120,7 +120,14 @@ (define* (check #:key tests? inputs #:allow-other-keys)
#t)
(define* (repack #:key inputs #:allow-other-keys)
(invoke "tar" "-czf" "../package.tgz" ".")
(invoke "tar"
;; Add options suggested by https://reproducible-builds.org/docs/archives/
"--sort=name"
(string-append "--mtime=@" (getenv "SOURCE_DATE_EPOCH"))
"--owner=0"
"--group=0"
"--numeric-owner"
"-czf" "../package.tgz" ".")
#t)
(define* (install #:key outputs inputs #:allow-other-keys)