no reproducible trisquel isos?

6 Antworten [Letzter Beitrag]
tonlee
Offline
Beigetreten: 09/08/2014
andyprough
Offline
Beigetreten: 02/12/2015

What is your question or comment @tonlee? Debian and Ubuntu also do not have reproducible builds - that is a very hard thing to accomplish. I think I read recently that openSUSE has reproducible builds now, or is very close to it.

tonlee
Offline
Beigetreten: 09/08/2014

> do not have reproducible builds

I wanted to get it confirmed that reproducibility is not available.

If one or more gnu linux systems decide to go underground then reproducible builds are important?

Magic Banana

I am a member!

I am a translator!

Offline
Beigetreten: 07/24/2010

It is important to avoid trusting trust attacks: https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf

Avron

I am a translator!

Offline
Beigetreten: 08/18/2020

I have not heard of "reproducible iso", rather of "reproducible builds" (https://en.wikipedia.org/wiki/Reproducible_builds).

Guix system does this. I know that people doing research like this because, with the exact same binaries, there is a good chance that the exact same input will produce the exact same output. I say good chance because I heard at least a case where, on different machines, even with the same binaries and the same input, the output was different (but I can't remember the details).

tonlee
Offline
Beigetreten: 09/08/2014

> have not heard of "reproducible iso"

I probably should have written reproducible builds.

tonino
Offline
Beigetreten: 03/13/2026

https://blog.josefsson.org/2024/07/10/towards-idempotent-rebuilds

"Summarizing the results, debdistrebuild is able to rebuild 34% of Debian bullseye on amd64, 36% of bookworm on amd64, 32% of bookworm on arm64. The results for trixie and Ubuntu are disappointing, below 10%.

So what causes my rebuilds to be different from the official rebuilds? Some are trivial like the classical problem of varying build paths, resulting in a different NT_GNU_BUILD_ID causing a mismatch. Some are a bit strange, like a subtle difference in one of perl’s headers file. Some are due to embedded version numbers from a build dependency. Several of the build logs and diffoscope outputs doesn’t make sense, likely due to bugs in my build scripts, especially for Ubuntu which appears to strip translations and do other build variations that I don’t do. In general, the classes of reproducibility problems are the expected. Some are assembler differences for GnuPG’s gpgv-static, likely triggered by upload of a new version of gcc after the original package was built."

https://blog.josefsson.org/2025/03/24/reproducible-software-releases
https://reproducible-builds.org/who/projects
https://lists.reproducible-builds.org/pipermail/rb-general/2024-March/003291.html