news.volyx.in

Debian bookworm live images now reproducible (lwn.net)

766 points by bertman · 494 days ago · 200 comments on HN

Article summary

Debian developer Roland Clobus announced that live images for Debian 12.10 are now 100% reproducible, but this claim was later corrected to note that they are not fully reproducible due to nonfree packages. The Debian wiki provides more information on the reproducible live images. Reproducible builds aim to ensure that given the same source code, build environment, and build instructions, anyone can recreate bit-by-bit identical copies of all specified artifacts. However, achieving full reproducibility can be challenging due to various factors such as nonfree packages and metadata.

Main themes

  • Reproducible builds
  • Debian live images
  • Nonfree packages
  • Build environment
  • Metadata and timestamps
  • Compiler and build tools

What commenters say

  • Reproducible builds require careful consideration of metadata such as timestamps, which can affect the reproducibility of builds.
  • Some argue that achieving full reproducibility is impossible due to the presence of nonfree packages, while others suggest that it is still possible with careful management of the build environment.
  • The use of date and time macros in code can make it difficult to achieve reproducible builds, and some compilers offer options to set these values to a fixed epoch.
  • Others argue that reproducibility is not necessary for local development builds, and that a more appropriate build reference should be used for release builds.
  • Some commenters suggest that tools like Git can be used to save the state of the tree at each build, allowing for easier tracking and debugging of changes.
  • There is disagreement over whether ASLR (Address Space Layout Randomization) can affect the reproducibility of builds, with some arguing that it can expose bugs in libraries and others claiming that it is not a significant issue.
  • The definition of 'source code' and what constitutes a 'reproducible build' is not always clear, and different people may have different interpretations of these terms.
  • Some argue that the benefits of reproducible builds, such as increased security and transparency, outweigh the challenges and complexities involved in achieving them.