The build is reproducible, and CI checks that it is - #183
Merged
Merged
Conversation
Every python -m build in a workflow now runs with SOURCE_DATE_EPOCH set to the commit's own timestamp, so the wheel is the same bytes wherever it is built; scripts/normalize_sdist.py does for the sdist what setuptools does not (copy times, uid, filesystem order, the gzip header), keeping every member and every byte of content. CI's package job builds a second time and diffs the hashes, so the property is checked on every pull request rather than claimed after a tag. CONTRIBUTING.md's Releases section says how to rebuild a release and compare it with PyPI. Measured before this change: two local builds of the same commit gave the same wheel and different sdists; after normalisation, the same sdist. Signed-off-by: arpan <contact@arpanghoshal.com>
|
Warning Review limit reachedNext included review available in 30 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (6)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
python -m buildinci.yml,publish.ymlandrelease.ymlruns withSOURCE_DATE_EPOCHset to the commit's own timestamp, so a wheel built from the same commit with the backend the lock names is the same bytes wherever it is built.scripts/normalize_sdist.py(new) rewrites the sdist deterministically: members sorted, mtimes set to the epoch, owner0:0, modes normalised, gzip header without name or timestamp. Every member and every byte of content is kept;twine check --strictstill passes and the package job's "sdist can run its own tests" step extracts it as before.packagejob builds a second time and diffs thesha256sumof both directories. Reproducible is a claim until something checks it.CONTRIBUTING.md, Releases: how anyone rebuilds a release and compares it with PyPI.Measured on this machine before the change: two builds of the same commit gave an identical wheel and two different sdists (tar mtimes and the gzip timestamp). After normalisation the two sdists are one hash. The property holds for every release cut after this merges; earlier releases were built without
SOURCE_DATE_EPOCH.This is the
build_repeatable(silver) andbuild_reproducible(gold) pair of the OpenSSF Best Practices criteria.Checklist
test_every_build_in_a_workflow_is_reproduciblereads every workflow step that builds and requires the export before and the normaliser after; two tests drivenormalize_sdist.pyon synthetic tarballs (two differing inputs become one byte string with content preserved; refuses a wheel and refuses to run without an epoch).CLAIMS.md. No README sentence changes.docs/changes.scripts/check.shgreen for what this touches: ruff,mypy --stricton the script, the repository suite.Mutation table
export SOURCE_DATE_EPOCHline removed fromrelease.ymltest_every_build_in_a_workflow_is_reproduciblenormalize_sdist.pycall removed frompublish.ymlmember.mtime = epochremoved from the normalisertest_normalize_sdist_makes_two_builds_of_the_same_tree_identical🤖 Generated with Claude Code