[guardian-dev] deterministic, repeatable build of LilDebi

[Michael Rogers]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 23/04/14 20:45, Hans-Christoph Steiner wrote:
> That looks like the final detail!  I'm even getting the exact same 
> META-INF/MANIFEST.MF, only the two signature files are different.
> They also have the exact same number of bytes.  Still different
> hashes though.  The sort order of the files is the same, just the
> timestamps of the files in the zip are different.

Brilliant!

> 'ant debug' does not like frozen time.  It should be possible to
> change the timestamps of the files before being zipped up into the
> jar using 'touch'. The files seem to all be staged in bin/
> beforehand.

Sounds good, that would avoid the need for something like SortJar to
sort and timestamp the jar entries.

We should probably test this on a couple of different filesystems to
ensure the entries are being added in an order that doesn't depend on
how the filesystem implements directories.

Cheers,
Michael
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQEcBAEBCAAGBQJTWXf2AAoJEBEET9GfxSfMNB4IAIvKOCF3BXl21fx2QOSON8Cc
alf40s/S6/6Y6TuLiszJFClQQCh5tqetE6VCTc6JHi/W9mzerC88vJmySr/9oFYK
eL+2JxMZ9XysHlj8ywH04vlUNuwoXdpKHtu+TEFkGqy08wkPEHNv2/FiXrgt1Yuh
vvnu7FmHP8cFffYVBJjegNfVsIZqJJiFhoDJ4C8mK4ErO/p+vJFh/za6ww1oESpf
b1FS+OGuzKqqzgzGYCN+uygnP0YioW3pe37XqDuG959fGl5ItxKV513opo5dCZP0
jyMwiIwG+rWxf7DSKkN9en+J0WhUPB4AwxLUm58oNTs5zYUhpzylqeaqf6Wy1Fw=
=kXkJ
-----END PGP SIGNATURE-----