The rebuilderd is available for independent verification of Arch Linux through reproducible builds.

Introduced toolkit rebuilderd, enabling independent checking of the distribution's binary packages by deploying a continuously running build process that verifies downloadable packages against those obtained through rebuilding on a local system. The tool is written in Rust and distributed under the GPLv3 license.

Currently, rebuilderd only supports experimental verification of packages from Arch Linux, but support for Debian is expected to be added soon. To run rebuilderd under the simplest conditions, it is sufficient install the rebuilderd package from the default repository, import the GPG key for environment verification, and activate the corresponding system service. It is possible to deploy a network of multiple rebuilderd instances.

The service monitors the status of the package index and automatically triggers the rebuild of new packages in a reference environment, the state of which is synchronized with the configurations of the main Arch Linux build environment. The rebuild process takes into account nuances such as exact dependency matching, the use of an unchanged composition and versions of the build tools, an identical set of options and default settings, and the preservation of the order of file builds (applying the same sorting methods). The build process settings exclude the addition of transient auxiliary information by the compiler, such as random values, references to file paths, and information about the date and time of the build.

Currently, reproducible builds are provided for 84.1% of packages from the core repository of Arch Linux, 83.8% from the extras repository, and 76.9% from the community repository. In comparison, in Debian 10, this figure is is 94.1%. Reproducible builds are an important link in ensuring security, as they allow any user to verify that the builds offered by the distribution match byte-for-byte the builds personally compiled from the source code. Without the ability to verify the identity of the binary build, users are left to blindly trust someone else's build infrastructure, which, if compromised, could lead to hidden backdoors being inserted.

Source: opennet.ru