undefined | Better HN

0 pointshanwenn11y ago0 comments

See http://bazel.io/docs/FAQ.html, "Will Bazel make my builds reproducible automatically?

For Java and C++ binaries, yes, assuming you do not change the toolchain. If you have build steps that involve custom recipes (eg. executing binaries through a shell script inside a rule), you will need to take some extra care:

Do not use dependencies that were not declared. Sandboxed execution (–spawn_strategy=sandboxed, only on Linux) can help find undeclared dependencies.

Avoid storing timestamps in generated files. ZIP files and other archives are especially prone to this.

Avoid connecting to the network. Sandboxed execution can help here too.

Avoid processes that use random numbers, in particular, dictionary traversal is randomized in many programming languages."

0 comments

3 comments · 2 top-level

hansjorg11y ago· 1 in thread

When you say Java, does that include Android? I see that Android is supported, but couldn't find anything about reproducibility.

Reproducible Android builds would be very interesting.

esrauch11y ago

http://bazel.io/docs/roadmap.html

It looks like they only have iOS and not Android in this first release, but they are planning on adding Android support ~June of this year.

fizbin11y ago

Specifically, people should note that many code generators are not carefully designed for strict reproducibility, and will stick time stamps in generated output.

Even if you undo that, code generation tools are liable to at some point traverse a dictionary without caring about whether the result is deterministic. I spent some time at Google fighting with antlr to try to get it to have deterministic output and I still think that I left some corner case uncovered.

j / k navigate · click thread line to collapse