[mosh-devel] Mosh OS X package build on Travis

[john hood]

On 10/31/16 12:41 AM, Jim Cheetham wrote:
> Quoting john hood (2016-10-31 17:12:06)
>> Alas, we will not get any kind of repeatable builds out of this, Travis
>> constantly updates their build images and we update to current Homebrew
>> for dependencies on every build.
> 
> That's the worst bit. Using external services that are *unlikely* to attack
> your process is generally just fine, as long as there is a way to verify their
> output.

The repeatability is of course no worse than what we've got now :)

> Perhaps you could use Travis to report in the buildability of a revision,
> and the source of a 'nightly build' version, but keep a repeatable
> build chain for official releases?

We already use Travis for CI builds on Linux and OS X.  I could of
course maintain a build VM for Mosh releases and snapshot it for each
release build, but having to maintain it (OS X upgrades, Xcode upgrades)
for Mosh's fairly infrequent releases is a significant burden for a
small project, and it would bring us full circle to manually-maintained
private builds.

We can at least report the Travis image id (I think this is already in
the build log) and the Homebrew version + Git revisions, and other tool
versions.  Homebrew has a way to dump its configuration ('homebrew info
--json=v1') which may or may not be complete.

The elephant in the room is that we're trying to improve builds for a
binary-only, proprietary OS with relatively ad-hoc installation,
configuration, packaging, etc.

regards,

  --jh


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: OpenPGP digital signature
Url : http://mailman.mit.edu/pipermail/mosh-devel/attachments/20161031/979b4969/attachment.bin