Repeatable builds and snapshots of package/library indexes

[binarin]

Build process downloads some files from the internet. Most of them are versioned, but following one don't contain any version info in URL and change quite often:

• http://downloads.arduino.cc/packages/package_index.json.gz
• http://downloads.arduino.cc/packages/package_index.json.sig
• http://downloads.arduino.cc/libraries/library_index.json.gz

So it's not possible to package it that way for any system that aims for repeatable builds. E.g. for my NixOS effort (NixOS/nixpkgs#17060) I had to create my own snapshots of those files.

Could you please provide some sort of daily or weekly snapshots? So any packager can consume them directly from some urls like http://downloads.arduino.cc/libraries/2016-07-18/library_index.json.gz

[cmaglie]

Hi @binarin

those files are no more downloaded to create the build:

• the downloaded package_index.json* files have been replaced by a package_index_bundled.json that describes only the bundled AVR core and is part of the git tree:
  e80c085
• the library_index.json is no more downloaded, since it's not needed to run the IDE (unless you want to install a new library but the Library Manager will take care to download an updated copy anyway in that case)
  d5dc479

This should solve the reproducible builds problem. Feel free to reopen the issue if I'm missing something.

[binarin]

Thanks a lot!