pathetic piss kitten (@kitten)

pathetic piss kitten @kitten@elizabeth.cat

why just npm? we could say the same of pip, maven, crates.io, etc

pathetic piss kitten @kitten@elizabeth.cat

maven doesn't even have a lockfile, you could be deploying malware and not even have it in your development environment

Leah Neukirchen @leah@blahaj.social

@kitten Maven doesn't autoupdate tho?

pathetic piss kitten @kitten@elizabeth.cat

@leah but it doesn't need to to cause issues. without any hash check, you could be pulling different code every time

alien cactus (211695-343)

@echedellelr@masfloss.net

@kitten @leah if you build the artifact, you are supposed to have a local maven repository.

at least that is the concept of how is done.

yet i am unsure if the local maven cache counts as local repository and if building the artifacts there is supported.

pathetic piss kitten @kitten@elizabeth.cat

@echedellelr @leah yes, but the issue comes when your code leaves your local machine to be built and deployed elsewhere, usually through a CI pipeline that will just download the dependencies again from the origin without caring about your local repository

alien cactus (211695-343)

@echedellelr@masfloss.net

@kitten @leah maybe i don't see the whole view but if that CI machine is building the code, you trust that machine or you trust the original repository it downloads the sources from?

and if it is the first case in which you trust that CI, then that CI is responsible of having a maven repository for its own builds

or you are speaking about outsourcing your binary builds to another machine?

in such a case, why your local machine cares about that?

i am a bit confused about the reponsibility chain here

alien cactus (211695-343)

@echedellelr@masfloss.net

@kitten @leah

i somehow get that you want a machine to build things from another repository, so your local machine with its own development code executes the code built from that CI.

but at the same time you want to trust the original repository skipping the CI and ensuring the CI is not compromised.

pathetic piss kitten @kitten@elizabeth.cat

@echedellelr @leah no, I don't trust the original repository it downloads the sources from, that's why I want a way to automatically check that what I'm downloading hasn't changed since the last time I downloaded it

alien cactus (211695-343)

@echedellelr@masfloss.net

@kitten @leah oh, so you want checksum caching?

pathetic piss kitten @kitten@elizabeth.cat

@echedellelr @leah i wouldn't use the word "caching" but yes. the equivalent to package-lock.json in npm, go.sum in Golang, and so on

alien cactus (211695-343)

@echedellelr@masfloss.net

@kitten @leah maven.apache.org/guides/mini/guide-reproducible-builds.html

maven local cache counts as maven local repository and it saves the checksums btw.

also, you can verify your output with original things with that.

Xerz 💗 @xerz@fedi.xerz.one

@echedellelr @kitten @leah

Notice: starting with Maven 4.0.0-beta-5, Reproducible Builds mode will be active by default (see MNG-8258), without modifying project’s pom.xml. Setting a value in your pom.xml will only be useful if you want to override the inherited value.

oh, that’s actually kinda neatneat

alien cactus (211695-343)

@echedellelr@masfloss.net

@xerz @leah @kitten maven.apache.org/resolver/expected-checksums.html

also reading about this

Xerz 💗 @xerz@fedi.xerz.one

@echedellelr @leah @kitten I’ll say tho, Maven per se does not guarantee reproducibility because, unlike e.g. Nix or Yarn, it’s not recreating its environment from scratch, so users can do whatever they want and break reproducibility anyway

but it’s trying

alien cactus (211695-343)

@echedellelr@masfloss.net

@xerz @leah @kitten what they provide is project reproducibility, which is exactly what they speak about

and yes, verification will fail if something in your environment is off

Xerz 💗 @xerz@fedi.xerz.one

@echedellelr @leah @kitten

A build is reproducible if given the same source code, build environment and build instructions, any party can recreate bit-by-bit identical copies of all specified artifacts.

again, they’re only giving the tools so that they’re possible, but they’re not making it automatic or mandatory, despite the changes in Maven 4… so much better than nothing (it most definitely stops MitM attacks), but still gonna make people push for Docker anyway

alien cactus (211695-343)

@echedellelr@masfloss.net

@xerz @leah @kitten pushing for docker is up to the user problem

you are mixing system reproducibility with artifact reproducibility.

if your project needs a whole system to be changed, something is bad in your project and should be adressed

Xerz 💗 @xerz@fedi.xerz.one

@echedellelr @leah @kitten well… the thing is that, by definition, as the one Maven states above, reproducible builds require environment reproducibility

so while sure, bad devs and maintainers exist and can mess things up… ideally the build system shouldn’t allow that at all

alien cactus (211695-343)

@echedellelr@masfloss.net

@xerz @leah @kitten no... i disagree with that statement and i think you misinterpret the example of environment with your views over nix and guix

Xerz 💗 @xerz@fedi.xerz.one

@echedellelr @leah @kitten That’s just a fact tho. For instance, if you write a Makefile that uses Bash features only available in newer Bash versions, you’ve done a reproducible build… so long as everyone has a compatible Bash version set as $SHELL. That is, as long as everyone can reproduce the environment (at least well enough).

That’s, again, right in Maven’s definition of a “reproducible build”.

alien cactus (211695-343)

@echedellelr@masfloss.net

@xerz @leah @kitten just no to the last thing.

Xerz 💗 @xerz@fedi.xerz.one

@echedellelr …Eche…

A build is reproducible if given the same […] build environment

alien cactus (211695-343)

@echedellelr@masfloss.net

@xerz again, you are misinterpreting and extending the definition of what is said there.

alien cactus (211695-343)

@echedellelr@masfloss.net

@xerz reproducible-builds.org/docs/perimeter/ for your information.

alien cactus (211695-343)

@echedellelr@masfloss.net

@xerz maven page links to reproducible builds main website, and follows that definition.

again, your whole system is not part of that. and if your project indeed finishes needing to push docker, that is something that is a problem in your project [if the intention was not to be executed in docker later]

Xerz 💗 @xerz@fedi.xerz.one

@echedellelr well, I was just writing exactly at the same time, so please give me some time

Maven’s definition is copy-pasted from reproducible-builds.org/docs/definition/

the link you quote does drop the bit-by-bit requirement for some reason, **but it describes the exact concept of a build environment I was mentioning, alongside a requirement for auditing (so, knowing the exact tools originally used for building):

At least the defined environment has a list of the tools used by the build process and their versions.

reproducible-builds.org’s homepage gets so strict about it, it goes for the Nix mentality entirely:

First, the build system needs to be made entirely deterministic: transforming a given source must always create the same result. For example, the current date and time must not be recorded and output always has to be written in the same order.

and so the link you’re quoting insists on the same idea

Leah Neukirchen @leah@blahaj.social

@kitten @echedellelr tada github.com/chains-project/maven-lockfile

pathetic piss kitten @kitten@elizabeth.cat

@leah @echedellelr yeah but that's cheating :blobcatgiggle: that's not part of maven

pathetic piss kitten @kitten@elizabeth.cat

@leah @echedellelr like, I might as well just start using Gradle, which does have that built-in

Xerz 💗 @xerz@fedi.xerz.one

@kitten @leah @echedellelr ….Gradle tho….

alien cactus (211695-343)

@echedellelr@masfloss.net

@kitten @leah is a maven plugin, as maven by definition is built to be extended.

so it can be considered part of maven if you see it in that way. however i need to check but i am nearly sure the issue is already addressed.