Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

repro_build_env_declared and repro_deps_pinned overlook native C/C++ build systems and toolchains

Open
#433 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
c, cpp, python
Domain
devtools

Research direction

Start by locating the implementations of repro_build_env_declared and repro_deps_pinned, then read the referenced evaluation report for context. Check how they detect project files and produce verification guidance. Done means native build declarations and dependency manifests are considered for C/C++ projects, with relevant toolchain and ABI guidance.

Written by the indexing model from the issue text.

Description

module-reproducibility

Description

For projects containing C or C++ source code, repro_build_env_declared and repro_deps_pinned only look for container/script files and high-level package locks (npm, Python, Cargo). They completely ignore native build declarations (Makefile, CMakeLists.txt, CMakePresets.json) and native dependency manifests (Conan, vcpkg).

What We Did

  1. Audited a repository containing C code built via Makefile with toolchain variables (CC = gcc-13).
  2. Ran darnit audit . --framework reproducibility --show-all.

What It Was Supposed To Do

When C/C++ files are present, the tool should check for C/C++ toolchain declarations and native dependency manifests, or tailor the verification guidance towards compiler version pinning and shared library ABI stability.

What We Got

Both controls returned INCONCLUSIVE (WARN), directing the user only to check for Dockerfiles, Nix files, or language lockfiles like Cargo.lock or uv.lock.

Proposed Enhancement

  1. When native code (.c, .cpp, .h) is detected in project context:
    • Check for CMake toolchain presets (CMakePresets.json) or compiler definitions in Makefiles.
    • Check for C/C++ dependency managers (conan.lock, vcpkg.json).
  2. Provide verification steps relevant to native code (pinning system toolchain and libc versions).

Reference report: https://github.com/Jaydeep869/darnit/blob/reproducibility-evaluation/reports/experiment_2_c_ctypes.md#bug-report-5-repro_build_env_declared-ignores-makefiles-toolchain-files-and-native-cc-compiler-definitions

Dominant language
Python
Stars
22
Forks
27
Avg merge
2d 28m
Merged PRs (30d)
40

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from darnitdevorg/darnit

All issues in darnitdevorg/darnit

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.