A Debian release team announced that reproducible builds will become a mandatory feature. Changes have been made to the build system, blocking the upload of new packages that do not support reproducible builds. Updating existing packages with build reproducibility regressions is also prohibited in the testing repository.
In Debian 13, which includes 36,427 source packages, the support for repeated builds is 96.9% for the x86_64 architecture and 96.8% for ARM64 architecture. In the Debian Testing repositories, the level of reproducible builds is estimated at 94.5% for ARM64 architecture and 75.7% for x86_64 when rebuilding 37,809 source packages. The reproducible builds test in the Debian Testing repository has failed for 1,141 packages (3%), while 7,952 packages (21%) experienced general compilation issues from source code.
Reproducible builds allow users to create their own builds that bit-for-bit match the precompiled binaries offered for download. Users can personally verify that the binaries distributed in packages and images are built from the provided source texts and do not contain hidden changes. The identity check of the binary build allows not to rely solely on trust in the distribution's build infrastructure, as a compromise of the compiler or build toolchain may lead to the insertion of hidden backdoors.
When creating reproducible builds, nuances such as exact dependency matching, using an immutable set and versions of the build tools, identical sets of options and defaults, preservation of file build order (using the same sorting methods), and disabling the addition of compiler non-deterministic metadata, such as random values, file path references, and build date and time information, are taken into account. Build reproducibility is also affected by bugs and race conditions in the toolchain.
Forrás: opennet.ru
