Struct DeterminismState 

pub struct DeterminismState {
    pub sde: i64,
    pub compile_time_allowlist: Vec<(String, String)>,
    pub runtime_allowlist: Vec<(String, String)>,
}

Fields

sde: i64

compile_time_allowlist: Vec<(String, String)>

runtime_allowlist: Vec<(String, String)>

Implementations

impl DeterminismState

pub fn seed_from_commit(commit_ts: i64) -> Result<Self>

Seed from a commit timestamp (seconds since UNIX epoch). All built- in compile-time allow-list entries listed in the spec’s contract table are added here.

Returns Err when commit_ts is negative — a negative epoch would propagate a bogus SOURCE_DATE_EPOCH into child processes (where shells / build tools may misinterpret it) and almost always indicates a corrupted commit graph or a test passing a sentinel like -1. Fail-fast is the correct UX for a determinism API.

Compile-time allow-list scope

Each entry below corresponds to an artifact pattern the crate::determinism_report verification harness will actually see in dist/. Entries are matched by *.ext suffix or exact filename against the basename of every file the harness walks under the per-run worktree’s dist/ tree. Pattern names that do not match any real emitter output are dead code (silently never resolve) — keep this list aligned with what stages actually drop into dist/.

Notably absent (and intentionally so):

• docker-manifest-descriptor / docker-image-blob: the docker stage is in crate::determinism_runner::SIDE_EFFECT_STAGES and skipped by the harness; the only docker file that lands in dist/ is a .digest text file written by buildx (a deterministic sha256). No need for an allow-list entry.
• apple-notarization-receipt: the notarize stage mutates existing artifacts in-place (staples) rather than emitting new files; no separate “receipt” artifact lands in dist/.
• *.exe-nsis: makensis writes plain .exe files into dist/windows/; the suffix .exe-nsis matches nothing the harness ever sees. NSIS-built .exe files only appear when running on Windows (or under Wine), and operators can use the runtime --allow-nondeterministic <name>=<reason> flag on those releases rather than hard-coding a dead sentinel here.

pub fn export_env(&self, cmd: &mut Command)

Export SOURCE_DATE_EPOCH onto a std::process::Command so child subprocesses (cargo, tar, sbom tools, etc.) see the reproducible epoch.

pub fn resolve_reason(&self, artifact: &str) -> Option<&str>

Resolve the allow-list reason for an artifact name. Compile-time entries win on collision per the spec’s “Operator escape / Precedence on collision” section. Returns None when the artifact is not in either list.

pub fn append_runtime(&mut self, artifact: String, reason: String)

Append a runtime allow-list entry. Caller is the CLI flag handler for --allow-nondeterministic <name>=<reason>.

Trait Implementations

impl Clone for DeterminismState

fn clone(&self) -> DeterminismState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DeterminismState

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for DeterminismState

fn default() -> DeterminismState

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for DeterminismState

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for DeterminismState

fn eq(&self, other: &DeterminismState) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for DeterminismState

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for DeterminismState

impl StructuralPartialEq for DeterminismState