Re: Distributed verification of release tarballs using Guix? (was Re: Releasing 2.2.5?)

[Ricardo Wurmus]

Hi Rob,

> Ludovic Courtès <address@hidden> writes:
>
>> One issue is that “make dist” is non-deterministic because the archive
>> contains timestamps; I’m sure there of other sources of non-determinism
>> though, because “make dist” was not designed with that in mind.
>>
>> The non-source byproducts in release tarballs are: the pre-built .go
>> files (which are optional), psyntax-pp.scm, and then Info files and all
>> the autotools machinery.  Are these those you had in mind?
>
> If you haven't already seen it, I'd also suggest consulting
> https://reproducible-builds.org.

Ludovic and other folks in the Guile and Guix communities are
participating in the reproducible builds effort since the first summit.

--
Ricardo