Yes, I’m very interested in working in this direction

I talked to Kelsey about it a bit after the talk

I dabble in the NixOS world and my understanding is that reproducability with the JVM is tough.

Do you know if the CLJS folks are looking at it as well? JS has it's own dependency craziness.

no, I don't have an understanding of the equivalent issues there

reproducibility is not really the bit that I'm focused on (re-reading the original question above) - that has never been a strong goal for us from Clojure perspective. what we do want is more traceability and verification

I do think it's important that we should be able to connect signed commits in git -> signed releases, with verification, and better tracking of both provenance and full dep set when you do an application build, and having those tools be as automatic and included as possible

as far as CLJS is concerned the only real hurdle is (RT/nextId) not being controllable. (gensym) uses it, so it pops up all over the place and ens up generating slightly different code each time since its an ever increasing integer

clojure.lang.RT that is

another hurdle is the :advanced compilation done by the Closure Compiler, its not fully deterministic either but would be closer with more "stable" JS generated by the cljs compiler

(regarding reproducibility that is)

We have experimented a bit with this, and opened https://ask.clojure.org/index.php/12249/bytecode-not-100-deterministic-given-identical-inputs at some point

By using the patched hashCode and patching a logging library we use, @U06GVE6NR was able to get a sizeable production clojure project to build reproducibly.

So I feel like the way to reproducible builds is probably not super hard

Depending on your setup, you may also need to do (some of) the things in https://reproducible-builds.org/docs/jvm/ Nix takes care of most of that if you're actually building via a derivation, though.

@U04V5VAUN your signing of the jars might not be for naught after all!

I’d like to take credit for being responsible about my verified github commits, but I only set it it all up because @U04VDQDDY’s planck repo required it!