Add a new repro image version / tag providing a bit for bit reproducible image

As a followup the related work done on the archlinux-wsl side on that matter a few months ago, this MR aims at adding a new repro image version / tag providing a bit for bit reproducible image.

Note that, to ensure the reproducibility of the image, the pacman keys need to be stripped from this image. With this image, people are therefore expected to run pacman-key --init && pacman-key --populate archlinux before being able to update the system and install packages via pacman. This justifies the creation of a separate repro tag, in order to avoid introducing such a breaking change for the already existing tags [1].

This MR includes every needed changes to:

  • Build and push a new repro image version / tag
  • Apply parameters needed to ensure reproducibility during its build (the other image version / tag builds remain untouched)
  • Add a new repro stage to the CI, aiming at rebuilding the repro image a second time and verifying its reproducibility status
  • Expand the README.md to mention this new repro image version / tag, including relevant information
  • Add user documentation on how to reproduce a repro image locally (in the new REPRO.md document)

[1] We have eventual leads on how to workaround this technical constraint, so we might be able to provide a bit-for-bit reproducible image including pacman working out of the box at some point in the future, but this needs extra testing and experimentation. We would therefore like to start with a separate repro tag (with pacman keys stripped) as a first milestone for now.

Closes #44 (closed)

Edited by Robin Candau

Merge request reports

Loading