[yocto] Yocto & long-term reproducibility of rebuilds

[Chris Tapp]

On 30 Jan 2012, at 18:34, Flanagan, Elizabeth wrote:

> On Mon, Jan 30, 2012 at 8:34 AM,  <paul_nathan at selinc.com> wrote:
>> Hi,
>>
>> I am investigating Yocto for a build system here. Part of my  
>> requirements
>> for a build system is auditable/traceable builds that can be  
>> replicated long
>> into the future (our company has a 10 year warranty on our  
>> products, and we
>> build products for the multidecade term). Initial examination of  
>> Yocto shows
>> that it builds packages from a number of different domains online,  
>> which
>> will not meet our requirements - we'll have to store these packages  
>> to
>> ensure these packages exist in the correct version long into the  
>> future.  I
>> know we can manually edit the SRC_URI setting in .bb files, but the  
>> more
>> general problem of package archiving exists.
>>
>
> I would avoid manually editing SRC_URI.
>
> Set up PREMIRRORS and BB_FETCH_PREMIRRORONLY. That would ensure that
> you avoided any upstream contamination.
>
> I am interested in any information or recommendations other users of  
> the
>> Yocto system have on how they have solved this sort of design  
>> constraint.

This sounds like a good a good article for the 'How Do I...' section  
on the wiki. Or is there already something similar on there?

Chris Tapp

opensource at keylevel.com
www.keylevel.com