On Mon, Jul 9, 2012 at 1:10 PM, Magnus Hagander <magnus@hagander.net> wrote:
>
>> In theory. In practice it seems unlikely anyone would ever take the
>> time and energy to build them themselves and actually verify them -
>> the effort to do so would be huge (for example, assembling the 9.2
>> build machine for the installers and building all the necessary
>> dependencies for all the supported platforms etc. has so far taken a
>> number of man weeks). To verify the binaries we put out, someone would
>> have to build an exact mirror of that environment. That's not to say
>> it shouldn't be possible of course. In fact, it wouldn't even be
>> possible, as we digitally sign some of the executables to appease
>> Windows, and we obviously cannot share that certificate.
>
> It should be possible, and it's a much smaller (though not necessarily
> small) effort if you only want to verify *one* version on *one*
> platform with *one* subset of modules.
Putting aside the signed binaries, which clearly cannot be reproduced
bit-perfect, it's really not that much smaller - versions don't matter
that much as we use the same env for each major version, and most
packages are dependent on the server build, which requires the
majority of dependencies. The only real time saver would be to only
try to reproduce a subset of the supported platforms.
--
Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake
EnterpriseDB UK: http://www.enterprisedb.com
The Enterprise PostgreSQL Company