Heh. I also felt that way, spent the first month after leaving looking for next closest thing.
The most exciting thing I found was Nix <https://nixos.org/nix/>, a hermetic build system + linux distro + config-based service manager, all built around a purely functional language.
The way it's actually used to build a lot of existing projects is coarse-grained — the Nix build actions might be simply "get tarball; untar; configure; make". (I think it may be combined with distcc/ccache for per-object caching, not sure).
But if they run existing tool to do the actual builds, how do they enforce hermetic dependencies? They force a specific absolute path structure where all inputs and outputs dirs include the (transitive) hashes.
[There is also some crazy rewriting of hashes inside binaries, which they claim works fine.]
The drawback is you can't move binaries or libs around; the benefit is multiple versions can coexist in-place.
I was planning to experiment with some pieces I was missing:
- Use bup <https://github.com/bup/bup> to chunk build products for incremental transmission of similar builds.
- Their build farm IIUC assumes long-running slaves; I wanted to build on public cloud only paying for burst activity.
Then I suddenly remembered that I write python and now javascript, which I can use without any kind of build, and gave it up :-)
But if I were to toy with hermetic building now, I'd look at basing it on Docker.
The most exciting thing I found was Nix <https://nixos.org/nix/>, a hermetic build system + linux distro + config-based service manager, all built around a purely functional language.
The way it's actually used to build a lot of existing projects is coarse-grained — the Nix build actions might be simply "get tarball; untar; configure; make". (I think it may be combined with distcc/ccache for per-object caching, not sure).
But if they run existing tool to do the actual builds, how do they enforce hermetic dependencies? They force a specific absolute path structure where all inputs and outputs dirs include the (transitive) hashes. [There is also some crazy rewriting of hashes inside binaries, which they claim works fine.]
The drawback is you can't move binaries or libs around; the benefit is multiple versions can coexist in-place.
I was planning to experiment with some pieces I was missing: - Use bup <https://github.com/bup/bup> to chunk build products for incremental transmission of similar builds. - Their build farm IIUC assumes long-running slaves; I wanted to build on public cloud only paying for burst activity.
Then I suddenly remembered that I write python and now javascript, which I can use without any kind of build, and gave it up :-)
But if I were to toy with hermetic building now, I'd look at basing it on Docker.