Should we move all code-generation into a dedicated profile?

[chrisdutz]

Hi all,

some of you might know that I'm sort of trying to move PLC4X to allow reproducible builds. One of the problems I came across, is that in BacNET, KNX and OPC-UA we fetch remote resources in order to generate code. The problem with this is, that this will make the build unreproducible as one new vendor id is enough to break everything and as every week several new vendor-ids are coming our way, we will never have fully reproducible builds.

Now I thought: We actually don't need to generate the code during the build as all of our code is checked in ... So I would like to create a new profile "option-with-code-generation" that contains all the fetching of remote resources, xslts and code-generation. And to have the default build no longer do this.

This way we can provide reproducible builds and I think with all current regulattion attepts in the EU (CRA) and in the US, we really should aim for providing reproducible builds as in many scenarios this is mandated. Also does Apache allow automated releases, but the main requirement for doing this, is to have a reproducible build.

So what are your thoughts on this?

Chris

[hutcheb]

Sounds like a reasonable idea.

[sruehl]

Yeah it is fine. Maybe have a github action which checks once per day or something if the codegen produces a a diff and notify per mail (or just update it by itself)