Toward a fully reproducible Debian

It's an interesting system. It's designed to allow for strict tracking and reproduction of arbitrary build artifacts, e.g. they want the guarantee that if someone says "hey I noticed a problem with this build from 10 years ago, it says it's #1039828?" then they can hit a button and reproduce build #1039828. So it has to be a VCS, so it can track the source corresponding to each build. It also expects you to check in your compilers etc. to source control (so it can find them later), has its own language for describing builds (so it can track provenance through the build), and exposes the source tree through a custom filesystem API (so it can run builds inside a chroot where it has complete control over all the files visible to the build tools).

Compaq and then Intel used it very heavily for a long time, for developing chips. (Maybe they still do?) This is an environment with incredibly complex custom build tooling that evolves over time (for a modern general purpose CPU, you don't design the chip, you design software that designs the chip), with multiple gigabytes of output on every build, test suites that can take weeks or months to run, shipped products that are supported for many years, and where a minor bug slipping through can cost $475 million [2]. So there's a *very strong* motivation to track *exactly* what you are testing and shipping, and Vesta's trade-offs make a lot of sense. I don't know if any more traditional software shops ever picked it up though.

Google's blaze/bazel systems solve a lot of similar problems for similar reasons, though AFAIK they don't bother aiming for bit-for-bit reproducibility. I think Facebook's buck is in a similar space too.

[1] http://www.vestasys.org/
[2] https://en.wikipedia.org/wiki/Pentium_FDIV_bug