←back to thread

Debian bookworm live images now reproducible

(lwn.net)
764 points bertman | 3 comments | 26 Mar 25 17:22 UTC | HN request time: 0.001s | source
Show context
imcritic ◴[26 Mar 25 17:36 UTC] No.43484638[source]▶
I don't get how someone achieves reproducibility of builds: what about files metadata like creation/modification timestamps? Do they forge them? Or are these data treated as not important enough (like it 2 files with different metadata but identical contents should have the same checksum when hashed)?
replies(10): >>43484658 #>>43484661 #>>43484682 #>>43484689 #>>43484705 #>>43484760 #>>43485346 #>>43485379 #>>43486079 #>>43488794 #
jzb ◴[26 Mar 25 18:35 UTC] No.43485346[source]▶
Debian uses a tool called `strip-nondeterminism` to help with this in part: https://salsa.debian.org/reproducible-builds/strip-nondeterm...

There's lots of info on the Debian site about their reproducibility efforts, and there's a story from 2024's DebConf that may be of interest: https://lwn.net/Articles/985739/

replies(1): >>43489144 #
frakkingcylons ◴[27 Mar 25 00:32 UTC] No.43489144[source]▶
I see this is written in Perl, is that the case with most Debian tooling?
replies(6): >>43489677 #>>43490179 #>>43490769 #>>43490826 #>>43491933 #>>43492219 #
1. lamby ◴[27 Mar 25 10:51 UTC] No.43492219[source]▶
One of the authors of strip nondeterminism is here. The primary reason it's written in Perl is that given that strip-nondeterminism is used when building 99.9% of all Debian packages, using any other language would have essentially made that language's runtime a dependency for all building Debian packages. (Perl is already required by the build process, whilst Python is not.)
replies(1): >>43494083 #
2. flkenosad ◴[27 Mar 25 14:33 UTC] No.43494083[source]▶
Question: is Perl the only runtime the Debian build process relies on?
replies(1): >>43508018 #
3. yrro ◴[28 Mar 25 17:32 UTC] No.43508018[source]▶
Any packages with "Essential: yes" (run 'apt list ~E' to see them) are required on any Debian system. Additionally, the 'build-essential' pulls in other packages that must be present to build Debian packages via its dependencies: https://packages.debian.org/sid/build-essential