DPDK patches and discussions
 help / color / mirror / Atom feed
From: Thomas Monjalon <thomas@monjalon.net>
To: Luca Boccassi <bluca@debian.org>,
	Stephen Hemminger <stephen@networkplumber.org>
Cc: Christian Ehrhardt <christian.ehrhardt@canonical.com>,
	Bruce Richardson <bruce.richardson@intel.com>,
	dev@dpdk.org, david.marchand@redhat.com, "Mcnamara,
	John" <john.mcnamara@intel.com>
Subject: Re: [PATCH] doc: ensure sphinx output is reproducible
Date: Mon, 20 May 2024 20:59:22 +0200	[thread overview]
Message-ID: <2862896.88bMQJbFj6@thomas> (raw)
In-Reply-To: <20240520083955.7aecc1d8@hermes.local>

20/05/2024 17:39, Stephen Hemminger:
> On Mon, 20 May 2024 10:53:07 +0100
> Luca Boccassi <bluca@debian.org> wrote:
> 
> > On Sun, 19 May 2024 at 22:11, Thomas Monjalon <thomas@monjalon.net> wrote:
> > >
> > > 19/05/2024 19:23, Luca Boccassi:  
> > > > On Sun, 19 May 2024 at 18:13, Thomas Monjalon <thomas@monjalon.net> wrote:  
> > > > >
> > > > > 19/05/2024 18:36, Luca Boccassi:  
> > > > > > On Sun, 19 May 2024 at 15:01, Thomas Monjalon <thomas@monjalon.net> wrote:  
> > > > > > > 17/05/2024 13:29, Luca Boccassi:  
> > > > > > > > On Mon, 27 Nov 2023 at 17:04, Bruce Richardson
> > > > > > > > <bruce.richardson@intel.com> wrote:  
> > > > > > > > >
> > > > > > > > > On Mon, Nov 27, 2023 at 05:45:52PM +0100, Thomas Monjalon wrote:  
> > > > > > > > > > I would prefer adding an option for reproducible build
> > > > > > > > > > (which is not a common requirement).
> > > > > > > > > >  
> > > > > > > > > Taking a slightly different tack, is it possible to sort the searchindex.js
> > > > > > > > > file post-build, so that even reproducible builds get the benefits of
> > > > > > > > > parallelism?  
> > > > > > > >
> > > > > > > > Given the recent attacks with malicious sources being injected in open
> > > > > > > > source projects, reproducible builds are more important than ever and
> > > > > > > > should just be the default.  
> > > > > > >
> > > > > > > Yes it should be the default when packaging.
> > > > > > > Why should it be the default for normal builds?  
> > > > > >
> > > > > > Build reproducibility is everyone's responsibility, not just Linux
> > > > > > distributions. There should be no difference between a "normal build"
> > > > > > and a "packaging build". As far as I know, it is still fully supported
> > > > > > for DPDK consumers to take the git repository, build it and ship it
> > > > > > themselves - those cases also need their builds to be reproducible.  
> > > > >
> > > > > Sorry I really don't understand this point.
> > > > > The goal of a reproducible build is to maintain a stable hash, right?
> > > > > This hash needs to be stable only when it is published, isn't it?
> > > > > So isn't it enough to give a build option for having a reproducible build?  
> > > >
> > > > The goal is that issues breaking reproducibility are bugs and treated
> > > > as such. You wouldn't have a build option to allow buffer overflows or
> > > > null pointer dereferences, and so on. "The program builds
> > > > reproducibly" today and in the future has the same importance as "the
> > > > program doesn't write beyond bounds" or "the program doesn't crash" -
> > > > they are not optional qualities, they are table stakes, and
> > > > regulations are only going to get stricter.  
> > >
> > > I hear the technical reasons and want to address them, but
> > > I don't understand how regulation comes in an open source project.  
> > 
> > Because they will start affecting the companies using DPDK in their
> > products. There are some things in supply chain security that are
> > purely the purview of companies shipping the final products, like
> > providing SBOMs, but there are things that aren't, like for example
> > having processes to handle security issues, or anything that requires
> > code changes, like this issue.
> 
> Reproducible must be the default. It should not be an option

OK I think I better understand, thanks.




  reply	other threads:[~2024-05-20 18:59 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-06-29 12:58 christian.ehrhardt
2023-06-29 13:02 ` Christian Ehrhardt
2023-07-03 15:29 ` Thomas Monjalon
2023-07-06 12:49   ` Christian Ehrhardt
2023-11-27 16:45     ` Thomas Monjalon
2023-11-27 17:00       ` Bruce Richardson
2024-05-17 11:29         ` Luca Boccassi
2024-05-19 13:54           ` Thomas Monjalon
2024-05-19 16:36             ` Luca Boccassi
2024-05-19 17:13               ` Thomas Monjalon
2024-05-19 17:23                 ` Luca Boccassi
2024-05-19 21:10                   ` Thomas Monjalon
2024-05-20  9:53                     ` Luca Boccassi
2024-05-20 15:39                       ` Stephen Hemminger
2024-05-20 18:59                         ` Thomas Monjalon [this message]
2024-05-26 11:30         ` Thomas Monjalon

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2862896.88bMQJbFj6@thomas \
    --to=thomas@monjalon.net \
    --cc=bluca@debian.org \
    --cc=bruce.richardson@intel.com \
    --cc=christian.ehrhardt@canonical.com \
    --cc=david.marchand@redhat.com \
    --cc=dev@dpdk.org \
    --cc=john.mcnamara@intel.com \
    --cc=stephen@networkplumber.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).