Lockfiles?

Posted Apr 17, 2025 13:02 UTC (Thu) by MrWim (subscriber, #47432)
In reply to: Lockfiles? by Cyberax
Parent article: What's new in APT 3.0

We’ve been using lockfiles for building images with apt for the past 7 years. We don’t achieve bit-for-bit, but rather functional reproducibility:

https://github.com/stb-tester/apt2ostree?tab=readme-ov-fi...

Previously discussed here: https://lwn.net/Articles/821367/

I’m a big fan of lockfiles and reproducibility - the lack of which makes things so much harder to manage and reason about. I think it would be great if Debian were to embrace such an approach. Under that model apt would be responsible for creating a lockfile and downloading packages, and then dpkg would then be responsible for transitioning the running system to match the given lockfile.

I don’t have the will to pursue such a change in Debian myself though.