←back to thread

Debian bookworm live images now reproducible

(lwn.net)
764 points bertman | 1 comments | 26 Mar 25 17:22 UTC | HN request time: 0.378s | source
Show context
imcritic ◴[26 Mar 25 17:36 UTC] No.43484638[source]▶
I don't get how someone achieves reproducibility of builds: what about files metadata like creation/modification timestamps? Do they forge them? Or are these data treated as not important enough (like it 2 files with different metadata but identical contents should have the same checksum when hashed)?
replies(10): >>43484658 #>>43484661 #>>43484682 #>>43484689 #>>43484705 #>>43484760 #>>43485346 #>>43485379 #>>43486079 #>>43488794 #
jzb ◴[26 Mar 25 18:35 UTC] No.43485346[source]▶
Debian uses a tool called `strip-nondeterminism` to help with this in part: https://salsa.debian.org/reproducible-builds/strip-nondeterm...

There's lots of info on the Debian site about their reproducibility efforts, and there's a story from 2024's DebConf that may be of interest: https://lwn.net/Articles/985739/

replies(1): >>43489144 #
frakkingcylons ◴[27 Mar 25 00:32 UTC] No.43489144[source]▶
I see this is written in Perl, is that the case with most Debian tooling?
replies(6): >>43489677 #>>43490179 #>>43490769 #>>43490826 #>>43491933 #>>43492219 #
1. jeltz ◴[27 Mar 25 06:17 UTC] No.43490826[source]▶
Last time I checked a lot was also written in Python.