You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It seems there is no build info carrying the actual time a binary was built. I know we have the filename but for our use case it is not sufficient, because it can be changed easily. We would like to be able to not run a binary older than 1 year (after build time).
The text was updated successfully, but these errors were encountered:
This goes counter to our approach of making builds reproducible. The same input should produce the same output.
Building a go program at a different time shouldn't produce any different code.
Recompiling a binary doesn't really make it any safer, you should instead be looking at the inputs to the build, eg dependency versions, and compiler versions, both of which are recorded.
As @seankhliao says, this is not something we want to do, at least not by default. And as @mvdan says, we have mechanisms for people who really want it to do it. I'm going to close this as infeasible. Please comment if you disagree.
It seems there is no build info carrying the actual time a binary was built. I know we have the filename but for our use case it is not sufficient, because it can be changed easily. We would like to be able to not run a binary older than 1 year (after build time).
The text was updated successfully, but these errors were encountered: