Fedora change aims for 99% package reproducibility (lwn.net)

Article summary

Fedora is aiming to achieve 99% package reproducibility by the release of Fedora 43, with a proposal to make package builds reproducible and allow bugs to be filed against packages that are not reproducible. Reproducible builds ensure that given the same source code, build environment, and build instructions, any party can recreate bit-by-bit identical copies of all specified artifacts. This effort is part of a larger movement in the open-source community to improve supply chain security. The proposal includes packaging a utility to allow developers to test the reproducibility of packages and setting up a public instance of rebuilderd to provide independent verification.

Main themes

• Reproducible builds
• Supply chain security
• Package management
• Open-source software
• Linux distributions
• Security vs convenience

What commenters say

• The tradeoff between security and convenience is a major concern in the development of software packages and distributions.
• Some argue that the current package management systems prioritize convenience over security, while others believe that security can be achieved without sacrificing convenience.
• The use of external package managers like PyPI and npm can introduce security risks, and some argue that distributions should provide the necessary packages instead.
• The idea of having a single, universal package format is seen as unrealistic, and some argue that distributions should focus on providing the latest versions of software instead of relying on external package managers.
• The importance of reproducible builds is emphasized as a means to improve supply chain security and prevent attacks.
• Some commenters argue that the focus on security is overblown, and that the actual impact of data breaches is not as significant as perceived.
• Others argue that the lack of security in some package managers and distributions is a result of prioritizing convenience and ease of use over security concerns.
• There is a need for a balance between functionality, security, and ease of use in software development and package management.