11

I like how Bitcoin Core uses Gitian to make their builds deterministic. But Gitian is also a really complicated workaround. Is there any research being done into alternatives for deterministic builds?

3

So having a deterministic/reproducible build system is more of a software development practice than it is a single piece of software like Gitian. There are a variety of projects that try to implement this practice which are listed below:

https://reproducible-builds.org/who/

Gitian handles the deterministic building through a virtual machine, and then the uploading and comparison of signatures through git. However, deterministic building is impossible to automate for all set of software, due to the wide range of things that can cause the compiled code to be different (for example read https://wiki.debian.org/ReproducibleBuilds/Howto or https://blog.torproject.org/blog/deterministic-builds-part-two-technical-details where they describe specific issues for reproducible builds in their particular projects). So at the end of the day, part of the reproducible build process is manually hunting down all the things that can cause the binaries to be different and fixing it.

So if you have a project like Debian with thousands of software packages and authors, part of the reproducible build system must be education and statistic tracking.

For smaller projects, what you need depends on the software libraries you are working with and what OS's you are distributing for. For example, Debian has their own reproducible build tools. You could use https://diffoscope.org/ to identify specific differences in your binaries.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.