vectordotdev / vectordotdev/vector
Make Vector builds fully reproducible
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 22.6k
- Forks
- 2.3k
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 146
Description
In order to ensure authenticity of Vector's executables, we need to make building of all our artifacts reproducible. So running the build process should always produce artifacts which match byte-by-byte, even if run on different machines and at different time.
This would make it possible to verify that binaries that we provide really match the source in Git by executing the same build commands locally and then matching the resulting artifacts with the ones which we distribute.
Related: Reproducible builds in Debian, #1663.
Currently our builds are not reproducible at least because of the use of built, which puts the build date into the binary, so that binaries built on different dates don't match.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing Vector’s build process and where built adds the build date to executables. Check how artifacts are produced across machines and times, then run identical build commands locally and compare the resulting artifacts byte-for-byte. Done means all distributed artifacts can be reproduced and matched from the source.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- build-system
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100