[Git][reproducible-builds/reproducible-presentations][master] transparency.dev summit talk: update slides as given
Holger Levsen (@holger)
gitlab at salsa.debian.org
Tue Oct 21 11:49:53 UTC 2025
Holger Levsen pushed to branch master at Reproducible Builds / reproducible-presentations
Commits:
1978a658 by Holger Levsen at 2025-10-21T13:49:44+02:00
transparency.dev summit talk: update slides as given
Signed-off-by: Holger Levsen <holger at layer-acht.org>
- - - - -
2 changed files:
- 2025-02-02-a-tale-of-several-distros-joining-forces-for-a-common-goal-reproducible-builds/index.html
- 2025-10-21-Reproducible-Builds-brief-summary-of-12-years-and-a-glimpse-into-the-future/todo
Changes:
=====================================
2025-02-02-a-tale-of-several-distros-joining-forces-for-a-common-goal-reproducible-builds/index.html
=====================================
@@ -3,7 +3,9 @@
<head>
<meta charset="utf-8">
- <title>a tale of several distros joining forces for a common goal: Reproducible Builds</title>
+ <title>
+ Reproducible Builds, a very brief summary of the last 12 years and a glimpse into the future
+ </title>
<meta name="apple-mobile-web-app-capable" content="yes">
<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
@@ -125,23 +127,39 @@
<body>
<div class="reveal">
<div class="slides">
- <section>
+
+ <section>
<br>
<h3>
- a tale of several distros joining forces<br> for a common goal: Reproducible Builds
+ Reproducible Builds,<br> a very brief summary of the last 12 years and a glimpse into the future
</h3>
- <br>
+ <!-- br>
<img src="images/reprobuilds-display.jpeg" style="height: 220px; border-radius: 10px;">
+ <br -->
+
+ <h6>
+ <small>
+ Holger Levsen<br>
+ </small>
+ </h6>
+ <img src="images/tdev_summit_banner.png" style="height: 370px;">
+ </section>
+
+ <section>
<br>
+ <h3>
+ Reproducible Builds<br> lack transparency logs<span class="fragment">,<br> can you help?!?</span>
+ </h3>
+ <!-- br>
+ <img src="images/reprobuilds-display.jpeg" style="height: 220px; border-radius: 10px;">
+ <br -->
<h6>
<small>
- Holger Levsen, Jelle van der Waa, kpcyrd<br>
- FOSDEM 2025<br>
- 2025-02-02, Brussels, Belgium
+ Holger Levsen<br>
</small>
</h6>
- <img src="images/FOSDEM_logo.svg" style="height: 70px;">
+ <img src="images/tdev_summit_banner.png" style="height: 370px;">
</section>
@@ -152,51 +170,22 @@
</section>
- <section data-background="images/FOSDEM_logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>Outline of this talk</h3>
- <ul>
- <li class="fragment">a brief history of the Reproducible Builds project</li>
- <li class="fragment">brief status reports about several distros</li>
- </ul>
- </section>
-
-
-
- <section data-background="images/FOSDEM_logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>About you</h3>
- <ul>
- <li class="fragment">Who knows about Reproducible Builds, why and how?</li>
- <li class="fragment">Who contribute(s|d) to Reproducible Builds?</li>
- <li class="fragment">Who knows that Reproducible Builds have been known for more than 10 years?<span class="fragment"> >30 years?</span></li>
- <li class="fragment">Who knows about SBOM? (Software Bill of Materials) ~= our .buildinfo files designed in 2014!</li>
- </ul>
- </section>
-
- <section data-background="images/FOSDEM_logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>About us</h2>
- <ol>
- <li> <li>
- <li> <li>
- <li> <li>
- <li> <li>
- <li> <li>
- <li> <li>
- </ol>
- </section>
-
-
-
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>About us</h2>
+
+ <section data-background="images/Capitole_du_libre_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <p>Who am I</p>
<ol>
- <li class="fragment">kpcyrd. Security Researcher. 🦝 🏴 Reproducible Builds since 2017, Debian and Alpine Linux since 2018, Arch Linux since 2019. <span class="fragment">Creator of <i>whatsrc.org</i>.</span></li>
- <li class="fragment">Jelle van der Waa. Arch Linux since 2012, Arch Linux Developer.</li>
- <li class="fragment">Holger Levsen / h01ger. Debian user since 1995. Working on Reproducible Builds since 2014.</li>
- <li class="fragment">We're aiming to make all ❤️ Free Software reproducible.</li>
+ <li>Holger Levsen / holger at debian.org, located in Hamburg, Germany. Born at 329 ppm. He/him. 🏳️🌈🏳️⚧️🖤😷</li>
+ <li>Debian user since 1995, contributing since 2001, Debian member since 2007. I ❤️ Debian.</li>
+ <li>Working on Reproducible Builds since 2014.
+ Aiming to make all ❤️ Free Software reproducible.</li>
+ <li class="fragment">Since 2015 I've been convinced that transparency logs are desirable for <em>any distributed software</em>, alas...
+ <li class="fragment">I'm here to present the work of <b>many</b> people:</li>
</ol>
</section>
+
+
<section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h4>according to https://reproducible-builds.org/who/people/</em></h4>
@@ -285,6 +274,7 @@
• James Fenn
• Jan Nieuwenhuizen
• Jan-Benedict Glaw
+ • Jarl Gullberg
• Javier Jardón
• Jelle van der Waa
• Jelmer Vernooij
@@ -382,34 +372,32 @@
</p>
</section>
- <section data-transition="none">
- <h2>Yesterday, 11 years ago...</h2>
- <img src="images/Screenshot_FOSDEM_2014.webm.png" width="80%">
- </section>
-
- <section data-transition="none">
- <h1>Yesterday, 10 years ago</h1>
- <img src="images/Screenshot_FOSDEM_2015.mp4.png" width="100%">
- </section>
-
- <section data-transition="none">
- <h3>Lunar passed away last November...</h3>
- <img src="images/lunar1.jpg" width="80%">
-lunarⒶdebian.org / https://lunar.anargeek.net
- </section>
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>according to https://reproducible-builds.org/who/projects/</h3>
-<p style="font-size: 100%">
+ <!-- section data-background="images/tdev_summit_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>About you</h3>
+ <ul>
+ <li class="fragment">Who knows about Reproducible Builds, why and how?</li>
+ </ul>
+ </section>
-Alpine Linux, Apache Maven, Arch Linux, Baserock, Bitcoin Core, BitShares, Buildroot, Civil Infrastructure Platform, coreboot, Debian, ElectroBSD, F-Droid, FreeBSD, Freedesktop SDK, Fedora, GNU Guix, Go, In-toto, MirageOS, Monero, NetBSD, NixOS, OpenEmbedded, openSUSE, OpenWrt, openEuler, Qubes OS, SecureDrop, Symfony, Tails, Talos Linux, TREZOR, Tor Browser, Webconverger, Yocto Project, Trisquel GNU/Linux, rattler-build, IzzyOnDroid
+ <section data-background="images/tdev_summit_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>The End</h3>
+ <h3>Thank you!</h3>
+ </section -->
- </p>
- </section>
+ <section data-background="images/tdev_summit_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>About you</h3>
+ <ul>
+ <li>Who knows about Reproducible Builds, why and how?</li>
+ <li class="fragment">Who contribute(s|d) to Reproducible Builds somewhere?</li>
+ <li class="fragment">Who knows that Reproducible Builds have been known for more than 10 years? <span class="fragment">>30 years?</span></li>
+ <li class="fragment">Who knows about SBOM? (Software Bill of Materials) ~= our .buildinfo files designed in 2014!</li>
+ </ul>
+ </section>
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h1>Introduction</h1>
</section>
@@ -488,85 +476,21 @@ Alpine Linux, Apache Maven, Arch Linux, Baserock, Bitcoin Core, BitShares, Build
</section>
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>How did we get there?</h2>
- <li class="fragment">Money</li>
- <li class="fragment">Edward Snowden</li>
- </section>
-
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>Why money?</h2>
- <li class="fragment">Bitcoin (the software) was made reproducible in 2011.</li>
- </section>
-
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>Why Snowden</h2>
- <span class="fragment"><li>Well...after Snowden:</li>
- <li>Torbrowser was made reproducible in 2013 by Mike Perry.</li>
- <li>That's Firefox. One of the biggest software projects in the world.</li></span>
- </section>
-
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>How did we <i>really</i> get there?</h2>
- <li>Money / Bitcoin</li>
- <li>Edward Snowden / Torbrowser</li>
- <li class="fragment">...and a LOT of work by MANY people over MANY years.</li>
- </section>
-
<section data-transition="none">
<img src="images/groupphoto_rws5_marrakesh_2019_animated.gif" width="100%">
</section>
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>2013 and 2014</h2>
- <ul>
- <li>Lunar hosted a brainstorming meeting at DebConf13.</li>
- <li class="fragment">and another one at DebConf14</li>
- </ul>
- </section>
- <section data-background-color="white">
+ <!-- section data-background-color="white">
<img src="images/fosdem2014-6.png" width="100%">
- </section>
-
- <section data-background-color="white">
- <img src="images/fosdem2014-1.png" width="100%">
- </section>
+ </section -->
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>2013 and 2014</h2>
- <ul>
- <li>Lunar hosted a brainstorming meeting at DebConf13,</li>
- <li>and another one at DebConf14, and a talk at FOSDEM 14!</li>
- <li>Patches for <code>dpkg</code>: sorting fixes and .buildinfo files (SBOM!)</li>
- <li class="fragment">In September 2014 Holger started systematic builds of Debian packages, twice. First just 100 packages, then all of them.</li>
- <li class="fragment">Mike Perry and Seth Schoen gave a presentation at Chaos Communication Congress in December 2014 (31C3) explaining the problem space very well.</li>
- </ul>
- </section>
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <img src="images/ccc2014-1.png">
- </section>
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <img src="images/ccc2014-2.png">
- </section>
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <img src="images/ccc2014-3.png">
- </section>
<section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<img src="images/ccc2014-4.png">
</section>
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <img src="images/ccc2014-5.png">
- </section>
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <img src="images/ccc2014-6.png">
- </section>
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <img src="images/ccc2014-7.png">
- </section>
<section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<img src="images/ccc2014-8.png">
</section>
@@ -579,33 +503,6 @@ Alpine Linux, Apache Maven, Arch Linux, Baserock, Bitcoin Core, BitShares, Build
<section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<img src="images/ccc2014-11.png">
</section>
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <img src="images/ccc2014-12.png">
- </section>
-
-
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>2015</h2>
- <ul>
- <li class="fragment">FOSDEM talk by Lunar and Holger, inviting the free software world to collaborate and tackle this problem.</li>
- <li class="fragment">CCCamp presentation by Lunar, showing many problems and their solutions.</li>
- <li class="fragment">1st Reproducible Builds Summit in Athens.</li>
- <li class="fragment">SOURCE_DATE_EPOCH spec</li>
- <li class="fragment">debbindiff by Lunar</li>
- </ul>
- </section>
-
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>2015</h2>
- <ul>
- <li>FOSDEM talk by Lunar and Holger, inviting the free software world to collaborate and tackle this problem.</li>
- <li>CCCamp presentation by Lunar, showing many problems and their solutions.</li>
- <li>1st Reproducible Builds Summit in Athens.</li>
- <li>SOURCE_DATE_EPOCH spec</li>
- <li>diffoscope by Lunar and ~84 other contributors</li>
- </ul>
- </section>
-
<section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
@@ -614,26 +511,14 @@ Alpine Linux, Apache Maven, Arch Linux, Baserock, Bitcoin Core, BitShares, Build
<li>timestamps, timestamps, timestamps<li></span>
<li class="fragment">build paths, build paths<li>
<li class="fragment">all the rest</li>
+ <li class="fragment">(and somewhere in there there might be backdoors...)</li>
</section>
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>Resources about unreproducibilities:</h2>
- <ul>
- <span class="fragment"><li>Lunar's talk at CCCamp 2015</li>
- <li>https://reproducible-builds.org/docs/ & /resources</li> </span>
- <span class="fragment">
- <li>It's much easier to show common pitfalls making a package unreproducible than the opposite:<ul>
- <li style="font-size: 85%">https://github.com/bmwiedemann/theunreproduciblepackage</li></ul></li</ul></li>
- </span>
- <li class="fragment">430 known issue types in reproducible-notes.git<li>
- </ul>
- </section>
-
<section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h2>SOURCE_DATE_EPOCH</h2>
<ul>
- <!-- li>Who knows about SOURCE_DATE_EPOCH?</li -->
+ <li>Who knows about SOURCE_DATE_EPOCH?</li>
<li class="fragment">Build time stamps are largly meaningless. SOURCE_DATE_EPOCH describes the time of the last modification of the source (in seconds since the Unix epoch).</li>
<span class="fragment"><li>The specification is from 2015 and was updated in 2017.
<li>https://reproducible-builds.org/docs/source-date-epoch/</li></span>
@@ -644,9 +529,9 @@ Alpine Linux, Apache Maven, Arch Linux, Baserock, Bitcoin Core, BitShares, Build
<section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h2>diffoscope</h2>
<ul>
- <!-- li class="fragment">Who knows about diffoscope?</li -->
- <li class="fragment">Who uses or has used diffoscope?</li>
+ <li class="fragment">Who knows about, or uses or has used diffoscope?</li>
<li class="fragment">diffoscope tries to get to the bottom of what makes files or directories different. It will recursively unpack archives of many kinds and transform various binary formats into more human-readable form to compare them.</li>
+ <li class="fragment">Text, HTML and/or JSON output</li>
<span class="fragment"><li>https://try.diffoscope.org</li>
<li>https://diffoscope.org</li></span>
</ul>
@@ -654,8 +539,7 @@ Alpine Linux, Apache Maven, Arch Linux, Baserock, Bitcoin Core, BitShares, Build
<section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h2>diffoscope</h2>
- <li>Text and HTML ouput</li>
- <li style="font-size: 75%" class="fragment">File formats supported include: Android APK files, Android boot images, Android package resource table (ARSC), Apple Xcode mobile provisioning files, ar(1) archives, ASM Function, Berkeley DB database files, bzip2 archives, character/block devices, ColorSync colour profiles (.icc), Coreboot CBFS filesystem images, cpio archives, Dalvik .dex files, Debian .buildinfo files, Debian .changes files, Debian source packages (.dsc), Device Tree Compiler blob files, directories, ELF binaries, ext2/ext3/ext4/btrfs/fat filesystems, Flattened Image Tree blob files, FreeDesktop Fontconfig cache files, FreePascal files (.ppu), Gettext message catalogues, GHC Haskell .hi files, GIF image files, Git repositories, GNU R database files (.rdb), GNU R Rscript files (.rds), Gnumeric spreadsheets, GPG keybox databases, Gzipped files, Hierarchical Data Format database, HTML files (.html), ISO 9660 CD images, Java class files, Java .jmod modules, JavaScript files,</li>
+ <li style="font-size: 75%">File formats supported include: Android APK files, Android boot images, Android package resource table (ARSC), Apple Xcode mobile provisioning files, ar(1) archives, ASM Function, Berkeley DB database files, bzip2 archives, character/block devices, ColorSync colour profiles (.icc), Coreboot CBFS filesystem images, cpio archives, Dalvik .dex files, Debian .buildinfo files, Debian .changes files, Debian source packages (.dsc), Device Tree Compiler blob files, directories, ELF binaries, ext2/ext3/ext4/btrfs/fat filesystems, Flattened Image Tree blob files, FreeDesktop Fontconfig cache files, FreePascal files (.ppu), Gettext message catalogues, GHC Haskell .hi files, GIF image files, Git repositories, GNU R database files (.rdb), GNU R Rscript files (.rds), Gnumeric spreadsheets, GPG keybox databases, Gzipped files, Hierarchical Data Format database, HTML files (.html), ISO 9660 CD images, Java class files, Java .jmod modules, JavaScript files,</li>
</section>
<section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h2>diffoscope</h2>
@@ -663,16 +547,11 @@ Alpine Linux, Apache Maven, Arch Linux, Baserock, Bitcoin Core, BitShares, Build
<li>Fallback on hexdump comparison, fuzzy-matching to handle renamings, and much more!</li>
</section>
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <!--section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h2>diffoscope example output</h2>
<li><a href="https-everywhere-5.0.6_vs_5.0.7.html">Example diffoscope output for https-everywhere 5.0.6 vs 5.0.7</a></li>
- </section>
-
+ </section-->
- <section data-background-color="white">
- <img src="images/logo.png" width="584">
- <h3>https://reproducible-builds.org</h3>
- </section>
<section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h2>Reproducible Builds Summits</h2>
@@ -683,7 +562,7 @@ Alpine Linux, Apache Maven, Arch Linux, Baserock, Bitcoin Core, BitShares, Build
<li>2019 Marrakech</li>
<li>2022 Venice</li>
<li>2023/2024 Hamburg</li>
- <li class="fragment">2025 Vienna?!?</li>
+ <li class="fragment">2025 Vienna</li>
</ul>
</section>
@@ -765,83 +644,6 @@ Warpforge.
<img src="images/groupphoto_rws4_paris_2018_small.png" width="100%">
</section>
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>Reproducible-builds.org funding</h3>
- <ul>
- <li class="fragment">r-b.o is a Software Freedom Conservancy (SFC) project since 2018, currently funding Chris Lambs, Mattia Rizzolo, Vagrant Cascadian, myself & <i>kpcyrd</i>.</li>
- <li class="fragment">Funding needed to support our continous work: community work, fixing upstreams, developing software, designing processes, the yearly summit...</li>
- <li class="fragment">Thank you, CIP, OTF & STF & all past financial sponsors and all hardware sponsors too ❤️ </li>
- </ul>
- </section>
-
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>about <em>rebuilderd</em></h2>
- <ul>
- <li class="fragment">support for rebuilding Arch, Debian and Tails</li>
- <li class="fragment">rebuilderd, rebuilderd-worker, rebuilderctl</li>
- <li class="fragment">development started in 2019 during Marrakech summit</li>
- <li class="fragment">several instances for Arch exist (about 5)</li>
- <li class="fragment">written in Rust by kpcyrd</li>
- <li class="fragment">available at https://github.com/kpcyrd/rebuilderd</li>
- <li class="fragment">installation with pacman -S, apk add, sudo make install, soon with sudo apt install (the worker already is in trixie)</li>
- </ul>
- </section>
-
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>about <em>rebuilderd</em></h2>
- <ul>
- <pre>
-{
- <span style="color:orange">"name"</span>: <span style="color:red">"rust-spytrap-adb"</span>,
- <span style="color:orange">"version"</span>: <span style="color:red">"0.3.3-2"</span>,
- <span style="color:orange">"distro"</span>: <span style="color:red">"debian"</span>,
- <span style="color:orange">"suite"</span>: <span style="color:red">"main"</span>,
- <span style="color:orange">"architecture"</span>: <span style="color:red">"amd64"</span>,
- <span style="color:orange">"input_url"</span>: <span style="color:red">"https://buildinfos.debian.net/buildinfo-pool/r/
- rust-spytrap-adb/rust-spytrap-adb_0.3.3-2_amd64.buildinfo"</span>,
- <span style="color:orange">"artifacts"</span>: [
- {
- <span style="color:orange">"name"</span>: <span style="color:red">"librust-spytrap-adb-dev"</span>,
- <span style="color:orange">"version"</span>: <span style="color:red">"0.3.3-2"</span>,
- <span style="color:orange">"url"</span>: <span style="color:red">"http://deb.debian.org/debian/pool/main/r/
- rust-spytrap-adb/librust-spytrap-adb-dev_0.3.3-2_amd64.deb"</span>
- },
- {
- <span style="color:orange">"name"</span>: <span style="color:red">"spytrap-adb"</span>,
- <span style="color:orange">"version"</span>: <span style="color:red">"0.3.3-2"</span>,
- <span style="color:orange">"url"</span>: <span style="color:red">"http://deb.debian.org/debian/pool/main/r/
- rust-spytrap-adb/spytrap-adb_0.3.3-2_amd64.deb"</span>
- }
- ]
-},
-</pre>
- </section>
-
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>about some distros...</h2>
- </section>
-
- <section data-background="images/archlinux.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>Arch Linux 2015-2025</h3>
- <ul>
- <li class="fragment">2015 - pacman records BUILDINFO</li>
- <li class="fragment">2017 - pacman S_D_E support & archlinux-repro</li>
- <li class="fragment">2019 - started archiving packages required for rebuilds</li>
- <li class="fragment">2020 - rebuilderd instance, [core] 86%</li>
- <li class="fragment">2024 - reproducible minimal container userland</li>
- <li class="fragment">2025 - 12% left to make reproducible (4 for minimal bootable install)</li>
- </ul>
- </section>
- <section data-background="images/archlinux.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>https://gitlab.archlinux.org/archlinux/rebuilderd-website</h3>
- <img src="images/Screenshot_2024-11-15_Arch_Linux_Reproducible_Status.png">
- </section>
-
- <section data-background="images/archlinux.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>https://dashboards.archlinux.org/d/PKkRg-FGz/rebuilderd</h3>
- <img src="images/Screenshot_2025_31_01_Arch_Linux_Reproducible_Dashboard.png">
- </section>
-
<section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h3>Short summary of Reproducible Debian</h3>
</section>
@@ -849,124 +651,172 @@ Warpforge.
<section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h3>Reproducible Builds for some parts of Debian are a reality today:</h3>
<ul>
- <li class="fragment">reproducible docker/podman images: docker.debian.net</li>
- <li class="fragment">reproducible live images: cdimage.debian.org</li>
- <li class="fragment">individual packages, useful for both developers and some users</li>
+ <span class="fragment">
+ <li>individual packages, useful for both developers and some users. >95% of 37000 source packages build reproducibly by now</li>
+ <li><code>mmdebstrap --variant=apt trixie</code></li>
+
+ </span>
+ <span class="fragment">
+ <li>reproducible docker/podman images: docker.debian.net</li>
+ <li>reproducible live images: cdimage.debian.org</li>
+ </span>
+</li>
+
+
</ul>
</section>
<section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>CI builders from 2015 until today and beyond</h2>
- </section>
-
- <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>CI results for Debian unstable, 20250202</h3>
- <img src="images/stats_pkg_state_20250202.png">
+ <h3>CI results for Debian unstable, 20250712</h3>
+ <img src="images/stats_pkg_state_20250712.png">
</section>
<section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>4015 reprodubility related bugs fixed (mostly upstreamed), 256 patches pending...</h3>
+ <h3>4347 reprodubility related bugs fixed (mostly upstreamed), 262 patches pending...</h3>
<img src="images/stats_bugs_sin_ftbfs_state.png">
</section>
<section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>45045 bugs in 11.5 years ~= 11 per day</h3>
+ <h3>47362 bugs in 12 years ~= 11 per day</h3>
<img src="images/stats_bugs_state.png">
<p>we rebuild constantly and find lots of FTBFS bugs</p>
</section>
-
<section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>Debian <em>testing</em> migration, soon we'll be getting real!</h2>
- <ul style="font-size: 94%">
- <li>2023: CI reproducible-builds results included in excuses output for Debian testing migration, but there is no penalty nor bonus yet.</li>
- <li class="fragment">July 2024: <code>snapshot.debian.org</code> got fixed and we can now do <b>rebuilds where the build is compared against what Debian distributes on ftp.debian.org</b> instead of CI builds.</li>
- <li class="fragment">September 2024: <code>debootsnap</code> and <code>debrebuild</code> (both from <code>devscripts</code>) fixed for good.</li>
- <li class="fragment">October 2024: work on https://reproduce.debian.net began.</li>
- </ul>
- </section>
+ <h2>CI builders from 2015 until today and beyond</h2>
+ <p>CI builders are great, but we also need rebuilders. And we want to have both.</p>
+ </section>
- <!-- section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>How to use debrebuild from src:devscripts in trixie</h3>
- <ul><code>
- <li class="fragment">wget https://buildinfos.debian.net/ftp-master.debian.org/buildinfo/2024/01/16/crun_1.13-1_amd64.buildinfo</li>
- <li class="fragment">debrebuild --builder=sbuild+unshare libaacs_0.11.1-3_amd64-source.buildinfo</li></code>
- <li class="fragment">voila!</li>
- </ul>
- </section -->
<section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h2><code>https://reproduce.debian.net</code></h2>
<ul>
- <li class="fragment">a <code>rebuilderd</code> instance, running since Q3 2024</li>
- <li class="fragment">rebuilding and comparing against what Debian distributes on <code>ftp.debian.org</code>.</li>
+ <li>Attempts to bit-for-bit identically rebuild each Debian binary package found in the distribution archive, using the .buildinfo file produced when the buildd originally built the package.</li>
+ <li class="fragment">For each distributed package, rebuilderd calls debrebuild that calls debootsnap, mmdebstrap and finally sbuild to build that package within a user namespace.</li>
</ul>
</section>
<section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3><code>https://amd64.reproduce.debian.net</code></h3>
- <img src="images/amd64_rdn.png">
+ <h2><code>https://reproduce.debian.net</code></h2>
+ <ul>
+ <li>a <code>rebuilderd</code> instance, running since Q3 2024</li>
+ <li>rebuilding and comparing against what Debian distributes on <code>ftp.debian.org</code>.</li>
+ <li class="fragment">rebuilderd is older but snapshot.debian.org was broken from 2019 until 2024...</li>
+ <!-- li class="fragment">actually it's eight instances atm, one for each arch...</li>
+ <li class="fragment">(thankfully <code>kpcyrd</code> fixed issue#163 yesterday, so we can have several suites on one instance.... more on this later) -->
+ </ul>
</section>
<section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3><code>https://i386.reproduce.debian.net</code></h3>
- <img src="images/i386_rdn.png">
+ <h2><code>reproduce.debian.net vs tests.r-b.o/debian</code></h2>
+ <ul>
+ <li class="fragment">The goal of reproduce.debian.net is to replicate the same build process that is used by Debian during package publication -- not to seek out additional sources of variance.</li>
+ <li class="fragment">Variance testing, used to find factors that can prevent packages from rebuilding reproducibly, will continue at https://tests.reproducible-builds.org/debian/reproducible.html.</li>
+ </ul>
</section>
- <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3><code>https://arm64.reproduce.debian.net</code></h3>
- <img src="images/arm64_rdn.png">
- </section>
- <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3><code>https://armhf.reproduce.debian.net</code></h3>
- <img src="images/armhf_rdn.png">
+ <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h2>about <em>rebuilderd</em></h2>
+ <ul>
+ <li>support for rebuilding Arch, Fedora, Debian and Tails</li>
+ <span class="fragment"><li>rebuilderd, rebuilderd-worker, rebuilderctl</li>
+ <li>written in Rust by <em>kpcyrd</em>, development started in 2019 during Marrakech summit</li></span>
+ <li class="fragment">available at https://github.com/kpcyrd/rebuilderd - installation with apt, pacman -S, apk add, sudo make install, soon with dnf too</li>
+ <li class="fragment">several instances for Arch exist (about 5), one instance for Fedora exists and so far, AFAIK, now also five for Debian
+ </ul>
</section>
<section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h4><code>https://riscv64.reproduce.debian.net</code></h4>
- <img src="images/riscv64_rdn.png">
- </section>
+ <h3><code>https://reproduce.debian.net</code></h3>
+ <ul>
+ <li><code>trixie, forky, unstable, experimental</code></li>
+ <li><code>trixie-security, trixie-proposed-updates, trixie-updates, trixie-backports</code></li>
+ <span class="fragment"><li><code>arch:all, amd64, arm64, armhf, i386, ppc64el, riscv64</code>
+ <li>coming soon: <code>s390</code></span>
+ <li class="fragment">This will be used for testing migration soon: eventually unreproducible packages will not be allowed to enter testing anymore.</li>
+ </ul>
+ </section>
+
+ <section data-background="images/archlinux.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>Arch Linux 2015-2025</h3> <span class="fragment">
+ <ul>
+ <li>2015 - pacman records BUILDINFO</li>
+ <li>2017 - pacman S_D_E support & archlinux-repro</li>
+ <li>2019 - started archiving packages required for rebuilds</li>
+ <li>2020 - rebuilderd instance, [core] 86%</li>
+ <li>2024 - reproducible minimal container userland</li>
+ <li>2025 - 12% left to make reproducible (4 for minimal bootable install)</li>
+ </ul>
+ </span>
+ </section>
+ <section data-background="images/archlinux.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>https://gitlab.archlinux.org/archlinux/rebuilderd-website</h3>
+ <img src="images/Screenshot_2024-11-15_Arch_Linux_Reproducible_Status.png">
+ </section>
- <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>missing</h2>
- <h4><code>https://armel.reproduce.debian.net</code></h4>
- <h4><code>https://ppc64el.reproduce.debian.net</code></h4>
- <h4><code>https://mips64el.reproduce.debian.net</code></h4>
- <h4><code>https://s390x.reproduce.debian.net</code></h4>
- </section>
+ <section data-background="images/archlinux.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>https://dashboards.archlinux.org/d/PKkRg-FGz/rebuilderd</h3>
+ <img src="images/Screenshot_2025_31_01_Arch_Linux_Reproducible_Dashboard.png">
+ </section>
- <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2><code>https://reproduce.debian.net</code></h2>
+
+
+ <section data-background="images/nixos.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>NixOS</h3>
<ul>
- <li>We are very happy to use the same tool for Debian as Archlinux.<li>
- <li class="fragment">However the Debian setup is still its infancy and scaling is more of an issue: 8 architectures instead of 1, 2 suites needed instead of 1 (and 3 once trixie has been released), and 3 times as many packages as Arch tests.</li>
- <li class="fragment">https://github.com/fepitre/package-rebuilder from Frédéric Pierre also exists. We love rebuilderd, but we also love software diversity.</li>
+ <span class="fragment"><li>https://luj.fr/blog/is-nixos-truly-reproducible.html - blog post by Julien Malka, summarizing his research article https://hal.science/hal-04913007.</li>
+ <li>The article explores the proportion of bitwise reproducible packages in the Nix package repository and its evolution between 2017 and 2023.</li></span>
+ <li class="fragment"><em>"Our most important finding is that the reproducibility rate in nixpkgs has increased steadily from 69% in 2017 to about 91% in April 2023."</em></li>
</ul>
- </section>
+ </section>
- <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2><code>https://reproduce.debian.net</code></h2>
- <h1>more help much welcome!</h1>
- </section>
+ <section data-background="images/nixos.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>NixOS</h3>
+ <ul>
+ <li>Talk yesterday in the <em>Nix and NixOS</em> track:<br> https://fosdem.org/2025/schedule/event/fosdem-2025-4430-how-reproducible-is-nixos-/
+ </ul>
+ <img src="images/nixos-reproducibility-overall-absolute.png" style="height: 400px;">
+ </section>
- <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h2>The diff between theory and practice?</code></h2>
- <h1>10% <div class="fragment"><small>at the moment!</div></small></h1>
- </section>
+ <section data-background="images/freebsd.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>FreeBSD</h3>
+ <ul>
+ <li>Talk at FOSDEM 2016 by Baptiste Daroussin: Reproducible builds in FreeBSD packages</li>
+ <li class="fragment">FreeBSD base system continously tested on jenkins.debian.net since 2015. Just as NetBSD is :)</li>
+ <li> </li>
+ <li> </li>
+ <li> </li>
+ <li> </li>
+ </ul>
+ </section>
- <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>The diff between theory and practice?</code></h3>
- <h2>96.6% in CI</h2>
- <h3>vs</h3>
- <h2>86.0% on reproduce.d.n</h2>
- <p class="fragment">but we've only been doing this for 3 months...</p>
- </section>
+ <section data-background="images/freebsd.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>FreeBSD and NetBSD</h3>
+ <ul>
+ <li>Talk at FOSDEM 2016 by Baptiste Daroussin: Reproducible builds in FreeBSD packages</li>
+ <li>FreeBSD base system continously tested on tests.reproducible-builds.org since 2015. Just as NetBSD is :)</li>
+ <li class="fragment">In 2016 there was WIP for reproducing FreeBSD ports and achieved 80%. And then this efford got stalled...</li>
+ <span class="fragment"><li>until now: https://freebsdfoundation.org/blog/zero-trust-builds-for-freebsd/</li>
+ <li>NetBSD: for most archs base system can be rebuild bit for bit identical on NetBSD and Linux...!
+ </li>
+ </ul>
+ </section>
- <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+
+ <section data-background="images/freebsd.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>FreeBSD</h3>
+ <ul>
+ <li>the zero-trust build project is scheduled from jan-aug 2025 and centers on the freebsd build process, and in particular, release building. the primary goal of this work is to enable the entire release process to run without requiring root access, and that build artifacts build reproducibly – that is, that a third party can build bit-for-bit identical artifacts.
+ </li>
+ <li class="fragment">[this] is one of five initiatives that together are aimed at advancing zero trust builds, software bill of materials (sbom), ci/cd automation, security controls in ports and packages, and technical debt reduction.</li>
+ </ul>
+ </section>
+
+ <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h2>How to reach 100% in practice</h2>
<ul>
<li class="fragment">100% reproducible is a political decision and nothing technical.</h3>
@@ -1033,186 +883,96 @@ Warpforge.
</section>
- <section data-background="images/nixos.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>NixOS</h3>
- <ul>
- <span class="fragment"><li>https://luj.fr/blog/is-nixos-truly-reproducible.html - blog post by Julien Malka, summarizing his research article https://hal.science/hal-04913007.</li>
- <li>The article explores the proportion of bitwise reproducible packages in the Nix package repository and its evolution between 2017 and 2023.</li></span>
- <li class="fragment"><em>"Our most important finding is that the reproducibility rate in nixpkgs has increased steadily from 69% in 2017 to about 91% in April 2023."</em></li>
- </ul>
- </section>
-
- <section data-background="images/nixos.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>NixOS</h3>
- <ul>
- <li>Talk yesterday in the <em>Nix and NixOS</em> track:<br> https://fosdem.org/2025/schedule/event/fosdem-2025-4430-how-reproducible-is-nixos-/
- </ul>
- <img src="images/nixos-reproducibility-overall-absolute.png" style="height: 400px;">
- </section>
-
- <section data-background="images/freebsd.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>FreeBSD</h3>
- <ul>
- <li>Talk at FOSDEM 2016 by Baptiste Daroussin: Reproducible builds in FreeBSD packages</li>
- <li class="fragment">FreeBSD base system continously tested on jenkins.debian.net since 2015. Just as NetBSD is :)</li>
- <li> </li>
- <li> </li>
- <li> </li>
- <li> </li>
- </ul>
- </section>
-
- <section data-background="images/freebsd.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>FreeBSD</h3>
- <ul>
- <li>Talk at FOSDEM 2016 by Baptiste Daroussin: Reproducible builds in FreeBSD packages</li>
- <li>FreeBSD base system continously tested on tests.reproducible-builds.org since 2015. Just as NetBSD is :)</li>
- <li class="fragment">In 2016 there was WIP for reproducing ports and achieved 80%. And then this efford got stalled...</li>
- <li class="fragment">until now: https://freebsdfoundation.org/blog/zero-trust-builds-for-freebsd/</li>
- </ul>
- </section>
-
-
- <section data-background="images/freebsd.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>FreeBSD</h3>
- <ul>
- <li>the zero-trust build project is scheduled from jan-aug 2025 and centers on the freebsd build process, and in particular, release building. the primary goal of this work is to enable the entire release process to run without requiring root access, and that build artifacts build reproducibly – that is, that a third party can build bit-for-bit identical artifacts.
- </li>
- <li class="fragment">[this] is one of five initiatives that together are aimed at advancing zero trust builds, software bill of materials (sbom), ci/cd automation, security controls in ports and packages, and technical debt reduction.</li>
- </ul>
- </section>
-
- <section data-background="images/netbsd.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>NetBSD</h3>
-
- <ul>Jan-Benedict Glaw wrote in November 2024:
- <li> On Linux, of 82 of all tested 94 port/arch combinations built successfully,
-with 78 building reproducible on two consecutive builds. [...]</li>
- <li> Building on NetBSD current, 83 (of 94) combinations build successfully, of
-those 68 were reproducible. [...]</li>
- <li class="fragment"><b> 44 (of 94) port/arch combinations are totally reproducible, creating bit-identical output on NetBSD and Linux. </b></li>
- </ul>
- </section>
+ <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>The path to 100% (using old CI numbers...)</h3>
+ <table>
+ <tr><th>suite</th><th>reproducible</th><th style="color: #ff0000">unreproducible</th></tr>
+<tr style="font-size: 60%">
+<td>stretch</td>
+<td>23040(93.2%)</td>
+<td><span style="color: #ff0000">1514</span></td>
+</tr><tr style="font-size: 60%">
+<td>buster</td>
+<td>26653(93.9%)</td>
+<td><span style="color: #ff0000">1405</span></td>
+</tr><tr style="font-size: 60%">
+<td>bullseye</td>
+<td>29698(96.2%)</td>
+<td><span style="color: #ff0000">761</span></td>
+</tr><tr style="font-size: 60%">
+<td>bookworm</td>
+<td>33240(96.9%)</td>
+<td><span style="color: #ff0000">670</span></td>
+</tr><tr>
+<td>trixie</td>
+<td>35000</td>
+<td><span style="color: #ff0000">256</span></td>
+</tr><tr>
+<td>forky</td>
+<td>40000</td>
+<td><span style="color: #ff0000">128 (but no regressions or new pkgs)</span></td>
+</tr><tr>
+</tr><tr>
+<td>forky+1</td>
+<td>45000</td>
+<td><span style="color: #ff0000">42 policy violations left</span></td>
+</tr><tr>
+<td>forky+2</td>
+<td>50000</td>
+<td><span style="color: #00ff00">0 (?!?!!! that's probably 2031)</span></td>
+</tr><tr>
- <section data-background="images/openSUSE.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>R-B-OS</h3>
- <ul>
- <li>Bernhard M. Wiedemann has been working on Reproducible Builds for OpenSUSE since 2016 as a QA/research project, producing arround 2000 patches, half of them sent upstream.</li>
- <li class="fragment">R-B-OS is a PoC built upon this work (and funded by NLNet) and is 100% reproducible! Some fixes are "not distro ready yet" though.</li>
- <li class="fragment" style="font-size: 90%">minimal VM image:<br>
- <span style="font-size: 77%">https://en.opensuse.org/openSUSE:Reproducible_openSUSE/Part1</span>
- </li>
- <li class="fragment" style="font-size: 90%">small DVD with some graphical UI:<br>
- <span style="font-size: 77%">https://en.opensuse.org/openSUSE:Reproducible_openSUSE/Part2</span>
- </li>
- </ul>
+</tr>
+</table>
</section>
- <section data-background="images/fedora.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>Fedora</h3>
- <ul>
- <li>Zbigniew Jędrzejewski-Szmek started to do rebuilds of Fedora in 2024.</li>
- <li class="fragment">https://in.waw.pl/~zbyszek/fedora/builds-f42-after-mass-rebuild.amd64.txt</li>
- <li class="fragment">AIUI: 5838 src rpms, of which 4799 / 82% built reproducible. (Not sure if CI or rebuilds.)</li>
- <li class="fragment">add-determinism https://github.com/keszybz/add-determinism</li>
- <li class="fragment">matrix channel: #reproducible-builds:fedora.im</li>
- </ul>
- </section>
+ <!-- section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <img src="images/ccc2014-13.png">
+ </section -->
<section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>Summary: theory vs practice</h3>
- <ul>
- <li>In theory, we are done. In practice, we have shown that Reproducible Builds can be done in theory.</li>
- <li class="fragment">Now we need to close the gap between theory and practice.</li>
- <li class="fragment">And those missing 4-5% in CI are also crucial however, or at least 1% of them. For Debian, 1% means 370 source packages...</li>
+ <h2>and there is more...</h2>
+ <p>but time is short. Still I want to mention:</p>
+ <ul><li>Torbrowser which started it all - together with Bitcoin client to be fair</li>
+ <li>Tails</li>
+ <li>FDroid</li>
+ <li>Maven central</li>
+ <li>...</li>
+ <span class="fragment">
+ <li>https://bootstrappable.org and https://whatsrc.org</li>
+ </span>
</ul>
</section>
-
<section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>Summary, looking forward</h3>
+ <h2>Reproducible Builds and transparency logs</h2>
<ul>
- <li>Many projects support or aim for Reproducible Builds today. This is a <b>huge</b> success. <span class="fragment">We wanted to change the (software) world, and we did.</span></li>
- <li class="fragment">Next: finish those last 1-5% upstream. (And there are some dragons too, eg PGO.)</li>
- <li class="fragment">Next: create rebuilderd infrastructure(s), processes, tools.</li>
- <li class="fragment">Also crucial: project-level consensus and commitment to Reproducible Builds in practice.</li>
+ <li>Transparency logs have been mostly out of scope for me personally, though I don't know of any other public efforts for distros.
+ <li class="fragment">Neither binary transparency nor signature transparency!
+ <li class="fragment">I'm here to collaborate and learn. Thanks for having me here. I'm also more than happy to help where I can.
+ <li class="fragment">Lets discuss in a breakout session?!
+ <li class="fragment">Be the change you want to see in the (FLOSS) world!
</ul>
- </section>
-
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <img src="images/ccc2014-13.png">
- </section>
-
-
- <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <img src="images/groupphoto_rb2023summit.jpg" style="height: 350px;">
- <h2>
- Thank you
- <br><small>… and all contributors out there!</small>
- </h2>
- <p> </p>
-
- <h4>
- <small>Holger Levsen <holger at reproducible-builds.org><br>
- Jelle van der Waa <jelle at archlinux.org><br>
- kpcyrd, @kpcyrd at chaos.social, github.com/kpcyrd<br>
- </small>
- </h4>
- </section>
+ </section>
<section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<img src="images/groupphoto_rb2023summit.jpg" style="height: 350px;">
- <h2>
+ <h3>
Thank you
<br><small>… and all contributors out there!</small>
- </h2>
+ </h3>
<p>Any questions? 🤷</p>
- <h4>
+ <p><small>
+ #debian-reproducible on irc.oftc.net<br>
#reproducible-builds on irc.oftc.net<br>
- rb-general at lists.reproducible-builds.org
- </small>
- </h4>
+ rb-general at lists.reproducible-builds.org<br>
+ Holger Levsen / h01ger / holger at reproducible-builds.org / holger at debian.org
+ </small> </p>
</section>
- <!-- section data-background="images/FOSDEM_logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>
- 22 unreproducible src packages out of the 1337 most popular
- </h3>
- <p style="font-size: 100%">
-
- rdma-core jpeg-xl graphviz qtwebengine-opensource-src pipewire tracker colord nss qtbase-opensource-src grub2 libu2f-host apg libdmapsharing libjcat bluez vlc coinor-cgl lynx underscore gegl ffmpeg bind9
- <p>
- </section>
-
- <section data-background="images/FOSDEM_logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>
- 96 build-essential-depends unreproducible source packages (out of 5500)
- </h3>
- <p style="font-size: 77%">
- maven-shared-utils rdma-core rustc php8.2 jpeg-xl subversion systemtap graphviz r-base pipewire pandas camlp-streams statsmodels colord chromium qt6-declarative nss qtbase-opensource-src python3.12 python3.13 cdi-api gdb pupnp pacemaker scim gcc-13-cross qemu efl bsh cxxtest codenarc fop jsoup hevea libnative-platform-java javaparser black pstoedit lucene4.10 gmetrics emoslib combblas node-function-bind gdcm xmlbeans yarl nbsphinx groovy fltk1.3 ruby-pygments.rb libapache-poi-java ldc doxygen ghc lombok h2database freetds jsch jboss-jdeparser2 dejagnu jts python-nacl servlet-api jaxb ocaml-topkg odc qtremoteobjects-everywhere-src mpich lucene8 secilc bluez vlc valgrind linux86 golang-golang-x-net coinor-cgl parallel lynx underscore asmtools rocm-hipamd libcamera nbconvert mypy petsc node-d3 qtconnectivity-opensource-src eckit eccodes frozenlist extlib emacs ffmpeg bind9 meson-python ipyparallel
- <p>
- </section>
-
- <section data-background="images/FOSDEM_logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>
- image sources:
- </h3>
- <p>
- <img src="images/lunar1.jpg" style="height: 220px; border-radius: 10px;">
- <br>
- https://mastodon.xyz/@mac_call/113448024657756100
- </p>
- <p>
- <img src="images/lunar2.jpg" style="height: 220px; border-radius: 10px;">
- <br>
- https://pouet.chapril.org/@infothema/113459042400198201
- </p>
- </section -->
-
-
</div>
</div>
=====================================
2025-10-21-Reproducible-Builds-brief-summary-of-12-years-and-a-glimpse-into-the-future/todo
=====================================
@@ -1,93 +1,2 @@
sponsors wanted somewhere?
-rb definition
- who knew this?
- who is on this slides: we
- who knows diffoscope
- who knows S_D_E
-
-rb & transparency logs:
- reproducible builds are nice, but without transparency logs who knows whether r-b are really used?
- (similar to backups are nice/useless, but everybody wants restore)
- obviously transparency logs are also nice without r-b, but do you really want to run unreproducible software/
- software transparency, used in the real world?
-
-sigstore debian
-sigstore vs sigsum
-TL used in the real world?
-
-sigsum & sigstore
- two different tools / implementations
-
-real world transparency
- ssl certs
- go
- android firmware
- linux firmware
- imessages
- applecloud
-hardly software, correct me if i'm wrong :)
-
-transparency world:
- log operators
- witnesses
-r-b world
- log operators
- rebuilders
- witnesses
--> probs double
-
-
-about me:
- i might not be aware of some CT efforts re: r-b
-
-r-b.o history
-rb history goes further back
-
-rb website with docs
-rb summit, this year in vienna
-
-previously ci tests
-now rebuilderd for arch, debian & fedora
-fedora release milestone
-suse rb-one or whatever thats called
-also: tails, fdroid, maven central, signal
-
-transparency logs
-personally i like them since 2015
- someone should do them ;)
- for the communities
-i am here to collaborate
-q & a / discussion
- be the change you want to see in the FLOSS world
-
-up until a year ago, there were only a few rebuilderd instances for archlinux
- no idea why they havent done transparency logs
- neither nix
-
-maybe
- mention bootstrappable
- mention whatsrc: kpcyrd> | 13:56:05> h01ger: you could include something like "since we do a verified path from source to binary, we still need to have transparency/consensus about our source inputs" and then point out that whatsrc came out of the reproducible builds community because of this :)
-
- be the change you want to see in Debian/Arch/Nix/whatever
- I'll be happy to help, if you need help and if i can help
-
-
-update
-
-
-
-debian
- specs: rebuilderd
- (DBs for 5 archs are 123G but 3.4G compressed)
- specs: worker
- update bugs and patches graphs
-
- 2015 talk
- reproducible.debian.net consisted of 14 jenkins jobs defined in 263 lines of yaml, 13 shell scripts making up 2049 loc, and 4 python scripts with 948 loc. (running on 1 computer i believe). and 81.7% of more than 17600 source packages where reproducible in CI.
- "We hope reproducible builds will become the norm." - one of the closing slides of the 2015 talk
- Future: Binary transparancy logs: public log of all software releases.
- 2014 talk by lunar at fosdem
- 2014 lunar found 62% reproducible packages out of >5000 tested.
- to the thanks/funding slide: thanks to osuosl and codethink, but also ionos and all other sponsors!
-
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-presentations/-/commit/1978a6585e37ae4f81d15ece9adfea1724bdd061
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-presentations/-/commit/1978a6585e37ae4f81d15ece9adfea1724bdd061
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-commits/attachments/20251021/f1eb49ee/attachment.htm>
More information about the rb-commits
mailing list