←back to thread

Debian bookworm live images now reproducible

(lwn.net)
764 points bertman | 1 comments | 26 Mar 25 17:22 UTC | HN request time: 0s | source
Show context
imcritic ◴[26 Mar 25 17:36 UTC] No.43484638[source]▶
I don't get how someone achieves reproducibility of builds: what about files metadata like creation/modification timestamps? Do they forge them? Or are these data treated as not important enough (like it 2 files with different metadata but identical contents should have the same checksum when hashed)?
replies(10): >>43484658 #>>43484661 #>>43484682 #>>43484689 #>>43484705 #>>43484760 #>>43485346 #>>43485379 #>>43486079 #>>43488794 #
jzb ◴[26 Mar 25 18:35 UTC] No.43485346[source]▶
Debian uses a tool called `strip-nondeterminism` to help with this in part: https://salsa.debian.org/reproducible-builds/strip-nondeterm...

There's lots of info on the Debian site about their reproducibility efforts, and there's a story from 2024's DebConf that may be of interest: https://lwn.net/Articles/985739/

replies(1): >>43489144 #
frakkingcylons ◴[27 Mar 25 00:32 UTC] No.43489144[source]▶
I see this is written in Perl, is that the case with most Debian tooling?
replies(6): >>43489677 #>>43490179 #>>43490769 #>>43490826 #>>43491933 #>>43492219 #
fooker ◴[27 Mar 25 03:38 UTC] No.43490179[source]▶
It’s helpful to think of Perl as a superior bash, rather than a worse python, when it comes to scripting.
replies(3): >>43491457 #>>43491620 #>>43492020 #
eviks ◴[27 Mar 25 09:06 UTC] No.43491620[source]▶
How is that helpful to ignore a better alternative just because a worse one exists?
replies(2): >>43491767 #>>43501196 #
1. fooker ◴[28 Mar 25 03:25 UTC] No.43501196{3}[source]▶
The same reason people write C++ instead of better^TM alternatives.

Pick the tool you already know and focus on solving the problem.