no reproducible trisquel isos?
- Anmelden oder Registrieren um Kommentare zu schreiben
What is your question or comment @tonlee? Debian and Ubuntu also do not have reproducible builds - that is a very hard thing to accomplish. I think I read recently that openSUSE has reproducible builds now, or is very close to it.
> do not have reproducible builds
I wanted to get it confirmed that reproducibility is not available.
If one or more gnu linux systems decide to go underground then reproducible builds are important?
It is important to avoid trusting trust attacks: https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf
I have not heard of "reproducible iso", rather of "reproducible builds" (https://en.wikipedia.org/wiki/Reproducible_builds).
Guix system does this. I know that people doing research like this because, with the exact same binaries, there is a good chance that the exact same input will produce the exact same output. I say good chance because I heard at least a case where, on different machines, even with the same binaries and the same input, the output was different (but I can't remember the details).
> have not heard of "reproducible iso"
I probably should have written reproducible builds.
https://blog.josefsson.org/2024/07/10/towards-idempotent-rebuilds
"Summarizing the results, debdistrebuild is able to rebuild 34% of Debian bullseye on amd64, 36% of bookworm on amd64, 32% of bookworm on arm64. The results for trixie and Ubuntu are disappointing, below 10%.
So what causes my rebuilds to be different from the official rebuilds? Some are trivial like the classical problem of varying build paths, resulting in a different NT_GNU_BUILD_ID causing a mismatch. Some are a bit strange, like a subtle difference in one of perl’s headers file. Some are due to embedded version numbers from a build dependency. Several of the build logs and diffoscope outputs doesn’t make sense, likely due to bugs in my build scripts, especially for Ubuntu which appears to strip translations and do other build variations that I don’t do. In general, the classes of reproducibility problems are the expected. Some are assembler differences for GnuPG’s gpgv-static, likely triggered by upload of a new version of gcc after the original package was built."
https://blog.josefsson.org/2025/03/24/reproducible-software-releases
https://reproducible-builds.org/who/projects
https://lists.reproducible-builds.org/pipermail/rb-general/2024-March/003291.html

