[Distutils] reproducible builds

Robin Becker robin at reportlab.com
Tue Mar 21 08:02:59 EDT 2017


On 21/03/2017 11:46, Marius Gedminas wrote:
> On Mon, Mar 20, 2017 at 11:30:59AM +0000, Robin Becker wrote:
.........
>
> I'm sure the reproducible builds folks will send you patches if they
> find any spots that you missed.  ;-)
>
>> Is there a way to excite dictionary ordering changes? I believe there was
>> some way to modify the hashing introduced when the dos dictionary attacks
>> were an issue. Would it be sufficient to generate documents with say Python
>> 2.7 and check against 3.6?
>
> Python 3.6 changed the dict implementation so the ordering is always stable
> (and matches insertion order).
>
> You'll want to test with Python 3.5, which perturbs the dict ordering
> randomly, as a side effect of the randomized string/bytes hashes (unless
> you fix it by setting the PYTHONHASHSEED environment variable[*])
>
>   [*] https://docs.python.org/3.3/using/cmdline.html#envvar-PYTHONHASHSEED
.......
thanks for this Marius; having started on the reproducibility trail I find the 
python 3.x output has more mismatches than I like ('cos of missed bugs).
-- 
Robin Becker


More information about the Distutils-SIG mailing list