{"id":123479,"date":"2025-04-12T15:05:20","date_gmt":"2025-04-12T13:05:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/utverzhdeno-obespechenie-povtoryaemyh-sborok-v-fedora-43"},"modified":"2025-04-12T15:05:20","modified_gmt":"2025-04-12T13:05:20","slug":"utverzhdeno-obespechenie-povtoryaemyh-sborok-v-fedora-43","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/utverzhdeno-obespechenie-povtoryaemyh-sborok-v-fedora-43","title":{"rendered":"Approval of reproducible builds in Fedora 43","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The FESCo (Fedora Engineering Steering Committee), responsible for the technical aspect of the Fedora Linux distribution development, has approved a project to ensure reproducible builds of packages in the upcoming Fedora 43 release. The initiative aims to achieve reproducible builds for at least 99% of the packages in the repository. <\/p>\n
Reproducible builds will allow users to create their own RPM packages that match the ready-to-download binary packages provided. The matches will be ensured at the level of core metadata and included files in the package (only the metadata with build time, build host, and digital signature verification will differ). Users will be able to verify personally that the binaries distributed in the packages are built from the provided source code and contain no hidden modifications. Checking the identity of a binary build allows reliance not just on trust in the distribution\u2019s build infrastructure; the compromise of a compiler or build tools could lead to hidden backdoors being inserted. <\/p>\n
In addition to security, reproducible builds will also be beneficial for quality control \u2014 issues when trying to achieve reproducible builds are often caused by errors or chaos in the code, such as the use of packages marked as 'noarch' and dependencies tied to specific hardware architectures. Reproducible builds will also simplify package development \u2014 after minor edits, rebuilt packages will only differ by elements directly related to the changes made, which significantly streamlines version comparison and change analysis. <\/p>\n
In the formation of reproducible builds, nuances such as exact dependency matching are taken into account; the use of an unchanged set and versions of build tools; an identical set of options and default settings; preserving the order of file builds (using the same sorting methods); and disabling the compiler from adding unstable metadata such as random values, file path references, and build date and time data. Errors and race conditions in the tooling also affect build reproducibility. <\/p>\n
The infrastructure of the Fedora project is already prepared for achieving reproducible builds. For example, previous releases have introduced changes to the build system that synchronize metadata regarding file modification times with the reference source code (mtime is now independent of the build time), as well as ensuring a consistent order of metadata and structures in binary files. At this stage, the coverage of reproducible builds is estimated at 90%. Achieving reproducible builds for the remaining 10% requires the involvement of maintainers of problematic packages. To encourage corrections in such packages, failures during reproducible builds are intended to be treated as build errors. <\/p>\n