Summary of the new feature / enhancement
Deterministic/reproducible builds are an undeniably important feature for auditability and security. Currently, Compress-PSResource doesn't provide support for that, and it should.
Currently, I post-process my packages to ensure fully reproducible output, which takes significant time in a build.
Proposed technical implementation details (optional)
There are a few sources of non-determinism I have observed in Compress-PSResource:
- The timestamps of files in the zipped package.
- The PSMDCP file name is non-deterministic. Consequently, the
.rels file content is non-deterministic.
- The
[Content_Types].xml content, notably the order of children, is non-deterministic. (? I remember observing this but couldn't give a stable reproduction at the moment.)
Suggestion.
- Make
Compress-PSResource deterministic by default. PSMDCP name can be a hash of non-.rels non-.psmdcp files, and [Content_Types].xml children should be sorted.
- Provide a new parameter
-Timestamp. When this parameter is set, all files in the package should use this timestamp.
Summary of the new feature / enhancement
Deterministic/reproducible builds are an undeniably important feature for auditability and security. Currently,
Compress-PSResourcedoesn't provide support for that, and it should.Currently, I post-process my packages to ensure fully reproducible output, which takes significant time in a build.
Proposed technical implementation details (optional)
There are a few sources of non-determinism I have observed in
Compress-PSResource:.relsfile content is non-deterministic.[Content_Types].xmlcontent, notably the order of children, is non-deterministic. (? I remember observing this but couldn't give a stable reproduction at the moment.)Suggestion.
Compress-PSResourcedeterministic by default. PSMDCP name can be a hash of non-.relsnon-.psmdcpfiles, and[Content_Types].xmlchildren should be sorted.-Timestamp. When this parameter is set, all files in the package should use this timestamp.