rjbou / orb

check opam package reproductibility

orb: check opam package reproductibility

This tool can check if an opam package build is reproductible (cf. https://reproducible-builds.org). It installs the package twice (different path & time) and check that installed files have the same hash.

Install & use

$ opam pin git+https://github.com/rjbou/orb
$ orb pkg [--diiffoscope]

This project is currently in early beta.

How does it work?

orb uses an already installed opam & opam root, and it follows those steps:

• Install of two new switches in /tmp
• Install of packages dependencies
• Install of required packages
• Retrieves hashes of installed files and look for mismatches
• Remove temporary switches

With option --diffoscope, mismatching files are copied locally and their diff generated, using diffoscope.

As orb generates temporary switches, packages dependencies are installed each time (also compiler), which can be time consuming when working on a package. Option --use-switches sw1,sw2 can be used to give reusable switches.

--keep-switches option permit to keep those generated switches for investigation needs. To manually remove them, don't just remove directory, but use opam switch remove <sw>.