undefined | Better HN

0 pointsFoxboron7y ago0 comments

And how is the build env recorded for timestamps and env variables? Is all of this standardized?

>we do only integrity checks now for packages downloaded from npm and via opam

Which is fine, but esy should be capable of accepting signatures and checking them against a given key.

0 comments

1 comments · 1 top-level

> And how is the build env recorded for timestamps and env variables? Is all of this standardized?

We do record the build env now in esy's own format, you run:

    esy build-plan PKG

to see the build plan (a-la Nix derivation) which is a JSON with build commands and environment.

As regarding timestamps we don't set SOURCE_DATE_EPOCH yet but we definitely plan to address that.

j / k navigate · click thread line to collapse