TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Perfectly Reproducible, Verified Go Toolchains

139 点作者 spacey超过 1 年前

4 条评论

gizzlon超过 1 年前
They use a Mac to compare the Ubuntu Go package to a self-compliled go from source:<p><i>&quot;Now we can diff the Go toolchain we’ve created on our Mac with the Go toolchain that Ubuntu ships:&quot;</i> [..]<p>&quot;<i>We’ve successfully reproduced the Ubuntu package’s executables&quot;</i> [..]<p><i>&quot;Note in particular that we’ve reconstructed the toolchain binaries bit-for-bit: they do not show up in the diff at all. That is, we proved that the Ubuntu Go binaries correspond exactly to the upstream Go sources.&quot;</i><p>Also, for your own programs:<p><i>&quot;For Go programs that don’t need cgo, a reproducible build is as simple as compiling with CGO_ENABLED=0 go build -trimpath. Disabling cgo removes the host C toolchain as a relevant input, and -trimpath removes the current directory&quot;</i>
mjl-超过 1 年前
It&#x27;s so great that you automatically get trivially reproducible builds with Go, even when cross-compiling. At least when not using cgo, which is why I avoid cgo.<p>Features like this take a lot of effort and aren&#x27;t very visible, but are very much appreciated. Thanks to everyone who worked on this!
Zababa超过 1 年前
That&#x27;s great news! Having recently started a job using Go, I like how the language is slowly but surely improving. It feels like it&#x27;s possible for me to catch up with what has already been done and the evolutions.
kunley超过 1 年前
Great for CI maybe... not so much on the traveller&#x27;s dev laptop where you want to be quick and often operate on a broken internet link.<p>So, as much as I appreciate what Russ Cox is doing in general, how to just switch it off?
评论 #37312998 未加载