• richmondez@lemdro.id
    link
    fedilink
    English
    arrow-up
    23
    ·
    1 day ago

    Can’t most serious compilers produce reproducible builds these days given the same build environment. I know there has been a drive towards reproducible builds in general for security verification purposes.

    • MajorasMaskForever@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      ·
      9 hours ago

      Yeah, but it does take a lot of work to coerce them to do it.

      GCC is honestly obnoxious, and you have to do a bunch of unintuitive things to get it. The compile stage needs the built-in RNG seeded, parent file paths stripped, you need to ensure that the date/time macros are not used anywhere, and you need to ensure that all command line flags are passed in the exact same order every time.

      I just went through this with GCC16 on a new project.

    • iegod@lemmy.zip
      link
      fedilink
      English
      arrow-up
      1
      ·
      12 hours ago

      Not only can they but certified toolchains exist in the safety critical space. Medical, aerospace, nuclear projects, and the like are often required to use and procure such toolchains as part of their validation.

    • Natanael@infosec.pub
      link
      fedilink
      English
      arrow-up
      5
      ·
      17 hours ago

      Not by default usually but yes, you need to do a lot of work to set all necessary configurations and sometimes provide your own RNG seed for things which insist on random looking values.