From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id CBBC14407B; Mon, 20 May 2024 20:59:27 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 6AC8B4067A; Mon, 20 May 2024 20:59:27 +0200 (CEST) Received: from fout6-smtp.messagingengine.com (fout6-smtp.messagingengine.com [103.168.172.149]) by mails.dpdk.org (Postfix) with ESMTP id 9F767400EF for ; Mon, 20 May 2024 20:59:25 +0200 (CEST) Received: from compute2.internal (compute2.nyi.internal [10.202.2.46]) by mailfout.nyi.internal (Postfix) with ESMTP id E64C81381559; Mon, 20 May 2024 14:59:24 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute2.internal (MEProxy); Mon, 20 May 2024 14:59:24 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=monjalon.net; h= cc:cc:content-transfer-encoding:content-type:content-type:date :date:from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to; s=fm1; t=1716231564; x=1716317964; bh=rzTCubOf6pb1uqBHWpXL9uVHm5uMcqMt1qnK+PBNVBA=; b= oWvca2xb3H/rpgDXs7i4JvYLLgdiPfntKUJ0Q7DYkcAFN4EBHiqiGb36F+/d8MFY ZNygUide0P1+yH99ew+A+tatdwMfD3NvDVTqnPAMpmROoDs/tCX7Qro+ukAbA69n zg2OU0ZPmTG5Xn6UpAQY3Dc2E50TsD3gYANdYLkgcZ7dRGw1gBN3UxsdOq7q9JUj 820XPtAzFg/aImvFI15PRWac9W8/kaWZN/TZqRLr0wGNCTYGhN74fJQpwhkPaXgq 52Ng50FmrcDtMEYDPW61xaZmbtEVT+c5J2so9GADcPf3Zuvi7C+2yoJNRye6aXuQ 25f0/GsJEYC82o1p7dQizw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm1; t=1716231564; x= 1716317964; bh=rzTCubOf6pb1uqBHWpXL9uVHm5uMcqMt1qnK+PBNVBA=; b=J eB+jKRpkXQ6xzEIdy6ZKdDNhkc4JVYUZd5qt3F5ZAgU7AYk5mGI/qEr3CYkr9T5H m8CjWY4PWToM8MoDdHxI9MDvY2JXuCeLxcCo/gtqIjEA0jtISAbzAb5gYjcZ6oJ8 Sjy8Yzd/MQ5R85lKAOy1MelVrb0QgB+j9NucVOQXgtGl1TuI1tPZm86t0Hrei0SL Z848hOYuWluGeDGAKMbaGbZ1n5oY6CelWihFZHmQHzb/w1UjQDQgTRAdEXJsiTvX Aq9uMv1+8QRHLGH/DOZcF8xxxa9gnvVBo44iYnW6c2amBio1DkdOTZ+Y+LJLs6b2 0nDga0ghINjtlczUsX8Iw== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvledrvdeitddguddtiecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd enucfjughrpefhvfevufffkfgjfhgggfgtsehtufertddttdejnecuhfhrohhmpefvhhho mhgrshcuofhonhhjrghlohhnuceothhhohhmrghssehmohhnjhgrlhhonhdrnhgvtheqne cuggftrfgrthhtvghrnhepjeduveehieevuddutdevfffgtdegkeeuveejffejgedtgeeg kefgvdeugfefkeejnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmrghilh hfrhhomhepthhhohhmrghssehmohhnjhgrlhhonhdrnhgvth X-ME-Proxy: Feedback-ID: i47234305:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Mon, 20 May 2024 14:59:23 -0400 (EDT) From: Thomas Monjalon To: Luca Boccassi , Stephen Hemminger Cc: Christian Ehrhardt , Bruce Richardson , dev@dpdk.org, david.marchand@redhat.com, "Mcnamara, John" Subject: Re: [PATCH] doc: ensure sphinx output is reproducible Date: Mon, 20 May 2024 20:59:22 +0200 Message-ID: <2862896.88bMQJbFj6@thomas> In-Reply-To: <20240520083955.7aecc1d8@hermes.local> References: <20230629125838.1995751-1-christian.ehrhardt@canonical.com> <20240520083955.7aecc1d8@hermes.local> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="utf-8" X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org 20/05/2024 17:39, Stephen Hemminger: > On Mon, 20 May 2024 10:53:07 +0100 > Luca Boccassi wrote: > > > On Sun, 19 May 2024 at 22:11, Thomas Monjalon wrote: > > > > > > 19/05/2024 19:23, Luca Boccassi: > > > > On Sun, 19 May 2024 at 18:13, Thomas Monjalon wrote: > > > > > > > > > > 19/05/2024 18:36, Luca Boccassi: > > > > > > On Sun, 19 May 2024 at 15:01, Thomas Monjalon wrote: > > > > > > > 17/05/2024 13:29, Luca Boccassi: > > > > > > > > On Mon, 27 Nov 2023 at 17:04, Bruce Richardson > > > > > > > > wrote: > > > > > > > > > > > > > > > > > > On Mon, Nov 27, 2023 at 05:45:52PM +0100, Thomas Monjalon wrote: > > > > > > > > > > I would prefer adding an option for reproducible build > > > > > > > > > > (which is not a common requirement). > > > > > > > > > > > > > > > > > > > Taking a slightly different tack, is it possible to sort the searchindex.js > > > > > > > > > file post-build, so that even reproducible builds get the benefits of > > > > > > > > > parallelism? > > > > > > > > > > > > > > > > Given the recent attacks with malicious sources being injected in open > > > > > > > > source projects, reproducible builds are more important than ever and > > > > > > > > should just be the default. > > > > > > > > > > > > > > Yes it should be the default when packaging. > > > > > > > Why should it be the default for normal builds? > > > > > > > > > > > > Build reproducibility is everyone's responsibility, not just Linux > > > > > > distributions. There should be no difference between a "normal build" > > > > > > and a "packaging build". As far as I know, it is still fully supported > > > > > > for DPDK consumers to take the git repository, build it and ship it > > > > > > themselves - those cases also need their builds to be reproducible. > > > > > > > > > > Sorry I really don't understand this point. > > > > > The goal of a reproducible build is to maintain a stable hash, right? > > > > > This hash needs to be stable only when it is published, isn't it? > > > > > So isn't it enough to give a build option for having a reproducible build? > > > > > > > > The goal is that issues breaking reproducibility are bugs and treated > > > > as such. You wouldn't have a build option to allow buffer overflows or > > > > null pointer dereferences, and so on. "The program builds > > > > reproducibly" today and in the future has the same importance as "the > > > > program doesn't write beyond bounds" or "the program doesn't crash" - > > > > they are not optional qualities, they are table stakes, and > > > > regulations are only going to get stricter. > > > > > > I hear the technical reasons and want to address them, but > > > I don't understand how regulation comes in an open source project. > > > > Because they will start affecting the companies using DPDK in their > > products. There are some things in supply chain security that are > > purely the purview of companies shipping the final products, like > > providing SBOMs, but there are things that aren't, like for example > > having processes to handle security issues, or anything that requires > > code changes, like this issue. > > Reproducible must be the default. It should not be an option OK I think I better understand, thanks.