From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 81D6544076; Mon, 20 May 2024 11:53:21 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 074EB402CD; Mon, 20 May 2024 11:53:21 +0200 (CEST) Received: from mail-yw1-f175.google.com (mail-yw1-f175.google.com [209.85.128.175]) by mails.dpdk.org (Postfix) with ESMTP id 9AE61400EF for ; Mon, 20 May 2024 11:53:19 +0200 (CEST) Received: by mail-yw1-f175.google.com with SMTP id 00721157ae682-61e01d5ea74so23070307b3.2 for ; Mon, 20 May 2024 02:53:19 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1716198799; x=1716803599; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=SBDExvOIgiQeyr+ys9KdCFh6QXmrRWArdrUva5Du6Bo=; b=pqq+0t5IG2FBKMlDipq5Ar/Pynsi9yHGnY/1hG3O7hhL7gcIQNnEDoKZV7GZLgbZzZ 1HJYue50muS0qjQFdh808sT6aJ0Z903bM6pPlTYuATeqcPw29rd4/Smnz0jz5Zd6vwGe 2Zja878S79RmMvaAsi7cM8VB5xu2QgMoYvmVr/WEKGjnrGxhkYvIRx5Rt8hWXC7MTvh7 qHvhAYghEQdCQDBncpF6f/FIx2bYoAFFIvY1BQsdvk+GNoTe6MiLdVaapzhtGGcw+56p kLLxa3TaQy+7IhsURCdEtIPqMq6C959ZVkSAmy6xAKOPxCU8juigG3VjECMWTjv8/FEf j6zg== X-Forwarded-Encrypted: i=1; AJvYcCUV6itTR2SjU0mICLZynMYEEkZYvBIYwgExPx8S9Q+UnT++S0KlOgwEZrSV29Wqq553vohgNIt0LDjiV4o= X-Gm-Message-State: AOJu0YxgbN4nOSskn2tPpU+4DNEWrPSviZAAyPb8X26h0MD76Qhm94PP 9ZtxEOLX/JluaH8hePdjjK1CDZLo3712naLVPacQBvFwlPNHrMl5xfGx1rIC X-Google-Smtp-Source: AGHT+IEnmIbNLH4zdaeVciZT83fqNiN5qQn0u2koCzLqm8jPvJLgSWYNJquKOeXsw994rPTEr7NRtg== X-Received: by 2002:a25:84c4:0:b0:df3:88ee:799c with SMTP id 3f1490d57ef6-df388ee85a4mr13348355276.7.1716198798438; Mon, 20 May 2024 02:53:18 -0700 (PDT) Received: from mail-yb1-f172.google.com (mail-yb1-f172.google.com. [209.85.219.172]) by smtp.gmail.com with ESMTPSA id 3f1490d57ef6-df4a278d05bsm418632276.14.2024.05.20.02.53.18 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 20 May 2024 02:53:18 -0700 (PDT) Received: by mail-yb1-f172.google.com with SMTP id 3f1490d57ef6-de603e3072dso2426572276.1 for ; Mon, 20 May 2024 02:53:18 -0700 (PDT) X-Forwarded-Encrypted: i=1; AJvYcCWEr/UmOs74SEnahRQg3rfyLFREm1u6o6luT6Jzg/zukm+8o8FTAUet7FAIOwx96ncPkS3y7OjdjhdjAAE= X-Received: by 2002:a05:6902:604:b0:dd1:40cf:942b with SMTP id 3f1490d57ef6-dee4f3709b4mr26264490276.48.1716198797912; Mon, 20 May 2024 02:53:17 -0700 (PDT) MIME-Version: 1.0 References: <20230629125838.1995751-1-christian.ehrhardt@canonical.com> <2121200.bB369e8A3T@thomas> <6628584.G0QQBjFxQf@thomas> In-Reply-To: <6628584.G0QQBjFxQf@thomas> From: Luca Boccassi Date: Mon, 20 May 2024 10:53:07 +0100 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCH] doc: ensure sphinx output is reproducible To: Thomas Monjalon Cc: Christian Ehrhardt , Bruce Richardson , dev@dpdk.org, david.marchand@redhat.com, "Mcnamara, John" Content-Type: text/plain; charset="UTF-8" X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org On Sun, 19 May 2024 at 22:11, Thomas Monjalon wrote: > > 19/05/2024 19:23, Luca Boccassi: > > On Sun, 19 May 2024 at 18:13, Thomas Monjalon wrote: > > > > > > 19/05/2024 18:36, Luca Boccassi: > > > > On Sun, 19 May 2024 at 15:01, Thomas Monjalon wrote: > > > > > 17/05/2024 13:29, Luca Boccassi: > > > > > > On Mon, 27 Nov 2023 at 17:04, Bruce Richardson > > > > > > wrote: > > > > > > > > > > > > > > On Mon, Nov 27, 2023 at 05:45:52PM +0100, Thomas Monjalon wrote: > > > > > > > > I would prefer adding an option for reproducible build > > > > > > > > (which is not a common requirement). > > > > > > > > > > > > > > > Taking a slightly different tack, is it possible to sort the searchindex.js > > > > > > > file post-build, so that even reproducible builds get the benefits of > > > > > > > parallelism? > > > > > > > > > > > > Given the recent attacks with malicious sources being injected in open > > > > > > source projects, reproducible builds are more important than ever and > > > > > > should just be the default. > > > > > > > > > > Yes it should be the default when packaging. > > > > > Why should it be the default for normal builds? > > > > > > > > Build reproducibility is everyone's responsibility, not just Linux > > > > distributions. There should be no difference between a "normal build" > > > > and a "packaging build". As far as I know, it is still fully supported > > > > for DPDK consumers to take the git repository, build it and ship it > > > > themselves - those cases also need their builds to be reproducible. > > > > > > Sorry I really don't understand this point. > > > The goal of a reproducible build is to maintain a stable hash, right? > > > This hash needs to be stable only when it is published, isn't it? > > > So isn't it enough to give a build option for having a reproducible build? > > > > The goal is that issues breaking reproducibility are bugs and treated > > as such. You wouldn't have a build option to allow buffer overflows or > > null pointer dereferences, and so on. "The program builds > > reproducibly" today and in the future has the same importance as "the > > program doesn't write beyond bounds" or "the program doesn't crash" - > > they are not optional qualities, they are table stakes, and > > regulations are only going to get stricter. > > I hear the technical reasons and want to address them, but > I don't understand how regulation comes in an open source project. Because they will start affecting the companies using DPDK in their products. There are some things in supply chain security that are purely the purview of companies shipping the final products, like providing SBOMs, but there are things that aren't, like for example having processes to handle security issues, or anything that requires code changes, like this issue.