from Hacker News

Perfectly Reproducible, Verified Go Toolchains

by spacey on 8/28/23, 6:24 PM with 5 comments

• by gizzlon on 8/29/23, 8:50 AM

  They use a Mac to compare the Ubuntu Go package to a self-compliled go from source:

  "Now we can diff the Go toolchain we’ve created on our Mac with the Go toolchain that Ubuntu ships:" [..]

  "We’ve successfully reproduced the Ubuntu package’s executables" [..]

  "Note in particular that we’ve reconstructed the toolchain binaries bit-for-bit: they do not show up in the diff at all. That is, we proved that the Ubuntu Go binaries correspond exactly to the upstream Go sources."

  Also, for your own programs:

  "For Go programs that don’t need cgo, a reproducible build is as simple as compiling with CGO_ENABLED=0 go build -trimpath. Disabling cgo removes the host C toolchain as a relevant input, and -trimpath removes the current directory"

• by mjl- on 8/29/23, 9:32 AM

  It's so great that you automatically get trivially reproducible builds with Go, even when cross-compiling. At least when not using cgo, which is why I avoid cgo.

  Features like this take a lot of effort and aren't very visible, but are very much appreciated. Thanks to everyone who worked on this!

• by Zababa on 8/29/23, 7:47 AM

  That's great news! Having recently started a job using Go, I like how the language is slowly but surely improving. It feels like it's possible for me to catch up with what has already been done and the evolutions.

• by kunley on 8/29/23, 2:33 PM

  Great for CI maybe... not so much on the traveller's dev laptop where you want to be quick and often operate on a broken internet link.

  So, as much as I appreciate what Russ Cox is doing in general, how to just switch it off?