Have you tried setting PYTHONHASHSEED=0?
In Nixpkgs I've recently introduced some patches to build the interpreter and packages reproducibly. I've build this package 5 times and they all produced the same output.
Edit: actually, I built 1.20 of urllib3.
Thanks for your reply. I think I have two distinct points in return:
First, if you can build it 5 times it doesn't mean the package is reproducible - the output is not specified by the language to be determinstic so it would be undefined behaviour. Also, consider the non CPython runtimes may/do have different dict implementations. :)
Second, a practical point, we/Debian can't set PYTHONHASHSEED=0 everywhere and for every package build.. that would be far too invasive and probably even impossible due to the way our packaging works. :(
A patch to fix the timestamp in the bytecode along with PYTHONHASHSEED gives us deterministic builds of the interpreter and packages.
We build each wheel and package for each Python interpreter version. I haven't checked yet the non-CPython interpreters.
Anyway, I can understand that you might not be able to set PYTHONHASHSEED but I do not see how you're then going to guarantee reproducible builds without 'fixing' many packages. E.g., in 3.x of CPython sets are used a lot. Do you intend in such situations to patch the code to use a list instead?
. Do you intend in such situations to patch the code to use a list instead?
Only when they result in non-determinstic output into build files. We have been doing this for Python 2.x already with great success (and actually not that many patches…)
I've committed this to the github repo. Thank you.