[junon]

That's absolutely no different than just installing and not re-installing. Docker adds nothing in this case.

Not re-building doesn't make your build reproducible. It just means that you're... not building. If I save the result of a single iteration of an RNG, I can't claim that the RNG always produces the same result because I saved the result somewhere...

[tekknik]

Where did they say they’re not building? Building your app does not mean you install the modules every time. Some apps are so large they have to be split into chunks / layers anyway. In golang this used to be the way you’d add deps, check the entire source into your version control.

[junon]

Building the same project even without re-installing node modules has absolutely no guarantee of reproducibility.

[tekknik]

Oh please explain what’s different. The entire code chunk is the same. How is that not reproducible?

[junon]

The code being the same != reproducible. Build tools can incorporate e.g. build timestamps into the built artifacts, or randomize the output for e.g. pattern scanning/patch deterrence.

The input is irrelevant. I think you should have a look at what reproducible builds really are before evangelizing them.

[tekknik]

So you’re incrementing a timestamp, but the code doesn’t change and it’s super important you change the timestamp and this is a reproducible build?

A reproducible build means anybody on any machine can build the same thing someone else has on theirs. That’s it.

[junon]

> A reproducible build means anybody on any machine can build the same thing someone else has on theirs. That’s it.

No. A reproducible build is a guarantee that two builders of the same codebase, or the same codebase built multiple times, will result in a bit-for-bit identical of all other builds of the same codebase, every time, guaranteed.

*There are no Node.js-related build systems in mainstream use I am aware of that have any such guarantees. No, docker does not make any such guarantees. No, just because you pinned dependencies does not make that guarantee. No, just because you archived the codebase and vendored your dependencies does not make that guarantee.*

Please educate yourself before dying on a hill for a topic you're misrepresenting entirely.