"Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch."
https://itsfoss.com/news/debian-makes-reproducible-builds-mandatory/
15
Replies
15
Boosts
@guix let's review packages acceptance based on their responsibility in light of GCD006
https://codeberg.org/guix/guix-consensus-documents/src/branch/main/006-package-deprecation.md
@bagder Deterministic, not stochastic. This is the way.
@bagder Deterministic, not stochastic. This is the way.
I checked the list of packages failing reproducibility, and one of the most puzzling items in the list was the LibreOffice suite. I wonder what exactly is making them fail the tests...
wild speculation: java
@bagder Nice! And also a little bit worrisome that this is new (though I realize there are some things that make it tricky) but better now than not.
@bagder reproducing pkgs seems to be a cool and secure thing
@bagder Wow, that's awesome! Does anyone know if Ubuntu also will force reproducible builds considering that Ubuntu is based on Debian?
Does this mean derivatives like Devuan automatically do this too?
Sick! Is Debian the first major distro making this a hard requirement? Haven't heard of any others.
#nixos is somewhat of pioneer in the space of reproducible builds and is 20 years old
@gonzo_askold @orpach.neocities.org sure, but nix has still included packages that not in themselves were done reproducible I'm pretty sure.
@bagder @gonzo_askold @orpach.neocities.org I think @guix may have the current highest fraction of reproducible builds in their main repo: https://qa.guix.gnu.org/branch/master If I'm interpreting their rather hard to find and minimal status page correctly. ~92.4% (34,765 of 37,618) of their packages are reproducible.
@bagder @gonzo_askold @orpach.neocities.org Indeed, Nix greatly increases the chances of producing reproducible packages by controlling the build environment.
That said, it does not magically make the final artefact reproducible. There can still be sources of non-determinism, and we try to track them down as much as possible.
So far, things are going well! :)
I'm not that knowledgeable about inside workings, but in theory (in my head) hashing all inputs does equate to byte-to-byte reproducibility, even if previous steps in the build process weren't written specifically to be reproduced
