Hacker News Reader

I would point out that is literally what ccache (and Google goma) does, but doesn't require deterministic builds. Instead, it records hashes of preprocessed input and compiler commandlines.

They don't make any security claims about this, it's just for speeding up builds.

View on HN

What we currently do --- hashing inputs --- is the same ccache way. We just don't yet sandbox with the granularity yet.

What we want to id hash outputs. Say I replace 1 + 2 with 0 + 3. That will cause ccache to rebuild. We don't want downstream stuff to also be rebuilt. C-linking withing a package is nice in parallelizable, but in the general case there is more dependency chains and now that sort of thing starts to matter.

Reply on news.ycombinator.com