repeatr

Signed packages are useful, but still don't solve the problem. One fairly simple thing you can do to improve this would be to include build scripts as part of the package, and allow people to run those build scripts through wapm. The exact versions of any involved tools will need to be recorded too, but since there arent too many ways to generate wasm blobs yet, this shouldnt be too out there. Eventually it would be great if everyone had fully reproducible build formulae (kinda like https://github.com/polydawn/repeatr).

Another option to this is Repeatr [1]. Repeatr is for -- like it says on the tin -- repeating things; and hopefully, reproducing them. It's all the containment (runc, underneath), plus the ability to pull in various filesystems, specified by hash. For concrete examples, you can see Repeatr building Repeatr reproducibly here [2], for its own releases (it's a Go project, so this looks a lot like what's going on in Fillipo's blog here). Another example is this formula for reproducible builds of Runc [3] -- it uses cgo, and became reproducible with go1.7, which was very exciting! The big gain is Repeatr's syntax for multiple inputs and built-in hash verification means you can assemble reproducible environments like this out of multiple filesystems (say, busybox from one place, golang compiler separately), they all cache separately, they all

I wrote Yet Another UUID [1] for my own purposes recently as well. Mine's based on Firebase's style UIDs [2] -- they sort roughly chronologically, because operationally, I find that irritates me less. Arbitrary choice? Entirely. Regrets? None. Do I recommend it for use? Also not at all. Unless you feel like it. It's fine. I guess. I've kind of given up on there being any purpose to a One True Spec for UUIDs. Count how many bits of entropy you want. Shove some CSPRNG into it. Call it a day. ¯\_(ツ)_/¯ (This a fine implementation, fwiw. I only mean to share my honest question as to whether there's any real utility to UUIDs-as-a-library.) [1] https://github.com/polydawn/repeatr/blob/dd41ca72421a173b5aa... [2] https://www.firebase.com/blog/2015-02-11-firebase-unique-ide...