LWN: Comments on "Debian bookworm live images now fully reproducible"

Reproducible from binaries

IanKelling — Sat, 29 Mar 2025 10:03:32 +0000

I misunderstood. Thank you for the correction.

Reproducible from binaries

pabs — Fri, 28 Mar 2025 08:52:56 +0000

Note that the reproducible build process here is from binary .deb files to binary .iso files, there are probably still some .deb files that aren't reproducibly buildable (even the libre ones).

correction: they are not fully reproducible due to nonfree packages.

pabs — Fri, 28 Mar 2025 08:50:04 +0000

There is some open firmware, they could be working on reproducibility for those:

https://wiki.debian.org/Firmware/Open

correction: they are not fully reproducible due to nonfree packages.

jbicha — Thu, 27 Mar 2025 13:02:17 +0000

It sounds to me like it depends on what your definition of "source code" is. And that's not nearly as simple to answer as it might appear.

correction: they are not fully reproducible due to nonfree packages.

intelfx — Thu, 27 Mar 2025 12:53:07 +0000

> Unless Debian starts producing fully free live images again, it is impossible to create fully reproducible live image of a current release.

Sure it is. For any binary artifact such as firmware, the original form equals to the deliverable. For a firmware file, the necessary and sufficient means of "fully reproducing" it is a single `cp` invocation.

I realize there is an agenda to push here, but perhaps don't use reproducibility to push it.

correction: they are not fully reproducible due to nonfree packages.

paravoid — Thu, 27 Mar 2025 11:15:04 +0000

I'm confused. Is Trisquel working on build reproducibility for device firmware? How?

correction: they are not fully reproducible due to nonfree packages.

IanKelling — Thu, 27 Mar 2025 08:39:17 +0000

The wiki says that because I just edited it to say that. But, the 17 number was based on incorrect info elsewhere on the debian wiki. The correct number for Debian 12 is 10 packages.

The problem is that Debian distributes binaries that it didn't build, and it doesn't have a copy of the source code required to build them. An unbuildable build is of course not a reproducable build. See also https://wiki.debian.org/DebianFreeSoftwareGuidelines.

correction: they are not fully reproducible due to nonfree packages.

Alterego — Thu, 27 Mar 2025 06:56:19 +0000

Debian wiki says that except 19 firmwares everything is reproducible.

What part is not reproducible or prevent it ? Can you explain more ?

correction: they are not fully reproducible due to nonfree packages.

IanKelling — Thu, 27 Mar 2025 06:03:41 +0000

Unless Debian starts producing fully free live images again, it is impossible to create fully reproducible live image of a current release.

As it says on https://reproducible-builds.org/docs/definition/: "A build is reproducible if given the same source code, build environment and build instructions, any party can recreate bit-by-bit identical copies of all specified artifacts."

If you want to create a fully reproducible image, I suggest contributing to Trisquel.