[Git][reproducible-builds/reproducible-presentations][master] 2 commits: actually base the talk on the...
Holger Levsen (@holger)
gitlab at salsa.debian.org
Thu May 7 16:33:36 UTC 2026
Holger Levsen pushed to branch master at Reproducible Builds / reproducible-presentations
Commits:
233ae2fa by Holger Levsen at 2026-05-07T18:25:16+02:00
actually base the talk on the 2025-07-15-reproduce.debian.net-rebuilding-what-is-distributed-from-ftp.debian.org one
Signed-off-by: Holger Levsen <holger at layer-acht.org>
- - - - -
37c6c75a by Holger Levsen at 2026-05-07T18:33:29+02:00
forward into 2026 to the minidebconf hamburg
Signed-off-by: Holger Levsen <holger at layer-acht.org>
- - - - -
4 changed files:
- − 2026-05-09-Reproducing-Debian-in-the-real-world/images/tdev_summit_banner.png
- − 2026-05-09-Reproducing-Debian-in-the-real-world/images/tdev_summit_logo.png
- 2026-05-09-Reproducing-Debian-in-the-real-world/index.html
- 2026-05-09-Reproducing-Debian-in-the-real-world/todo
Changes:
=====================================
2026-05-09-Reproducing-Debian-in-the-real-world/images/tdev_summit_banner.png deleted
=====================================
Binary files a/2026-05-09-Reproducing-Debian-in-the-real-world/images/tdev_summit_banner.png and /dev/null differ
=====================================
2026-05-09-Reproducing-Debian-in-the-real-world/images/tdev_summit_logo.png deleted
=====================================
Binary files a/2026-05-09-Reproducing-Debian-in-the-real-world/images/tdev_summit_logo.png and /dev/null differ
=====================================
2026-05-09-Reproducing-Debian-in-the-real-world/index.html
=====================================
@@ -4,7 +4,7 @@
<head>
<meta charset="utf-8">
<title>
- Reproducible Builds, a very brief summary of the last 12 years and a glimpse into the future
+ reproduce.debian.net - rebuilding what is distributed from ftp.debian.org
</title>
<meta name="apple-mobile-web-app-capable" content="yes">
<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
@@ -127,39 +127,23 @@
<body>
<div class="reveal">
<div class="slides">
-
- <section>
+ <section>
<br>
<h3>
- Reproducible Builds,<br> a very brief summary of the last 12 years and a glimpse into the future
+ reproduce.debian.net: <br/> rebuilding what is distributed from ftp.debian.org
</h3>
- <!-- br>
- <img src="images/reprobuilds-display.jpeg" style="height: 220px; border-radius: 10px;">
- <br -->
-
- <h6>
- <small>
- Holger Levsen<br>
- </small>
- </h6>
- <img src="images/tdev_summit_banner.png" style="height: 370px;">
- </section>
-
- <section>
<br>
- <h3>
- Reproducible Builds<br> lack transparency logs<span class="fragment">,<br> can you help?!?</span>
- </h3>
- <!-- br>
<img src="images/reprobuilds-display.jpeg" style="height: 220px; border-radius: 10px;">
- <br -->
+ <br>
<h6>
<small>
Holger Levsen<br>
+ MiniDebConf Hamburg 2026<br>
+ May 9th 2026
</small>
</h6>
- <img src="images/tdev_summit_banner.png" style="height: 370px;">
+ <img src="images/minidebconfhh2026-logo.svg" style="height: 70px;">
</section>
@@ -172,30 +156,40 @@
- <!-- section data-background="images/tdev_summit_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <section data-background="images/minidebconfhh2026-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h3>About you</h3>
<ul>
<li class="fragment">Who knows about Reproducible Builds, why and how?</li>
</ul>
</section>
- <section data-background="images/tdev_summit_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <section data-background="images/minidebconfhh2026-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h3>The End</h3>
<h3>Thank you!</h3>
- </section -->
+ </section>
- <section data-background="images/tdev_summit_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <section data-background="images/minidebconfhh2026-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h3>About you</h3>
<ul>
<li>Who knows about Reproducible Builds, why and how?</li>
- <li class="fragment">Who contribute(s|d) to Reproducible Builds somewhere?</li>
+ <li class="fragment">Who contribute(s|d) to Reproducible Builds?</li>
<li class="fragment">Who knows that Reproducible Builds have been known for more than 10 years? >30 years?</li>
+ <li class="fragment">Who was at the first reproducible builds BoF at DebConf13?</li>
<li class="fragment">Who knows about SBOM? (Software Bill of Materials) ~= our .buildinfo files designed in 2014!</li>
</ul>
</section>
-
+ <section data-background="images/minidebconfhh2026-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>Outline of this talk</h3>
+ <ul>
+ <li class="fragment">explain reproduce.debian.net
+ <li class="fragment">current status and outlook
+ <li class="fragment">(nothing outside Debian though there have been huge progresses too)
+ </ul>
+ </section>
+
+
<section data-background="images/Capitole_du_libre_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<p>Who am I</p>
<ol>
@@ -203,8 +197,8 @@
<li>Debian user since 1995, contributing since 2001, Debian member since 2007. I ❤️ Debian.</li>
<li>Working on Reproducible Builds since 2014.
Aiming to make all ❤️ Free Software reproducible.</li>
- <li class="fragment">Since 2015 I've been convinced that transparency logs are desirable for <em>any distributed software</em>, alas...
- <li class="fragment">Finally I'm here to present the work of <b>many</b> people:</li>
+ <li>Ask me anything, anytime. This is a pretty complex topic.</li>
+ <li class="fragment">I'm here to present the work of <b>many</b> people:</li>
</ol>
</section>
@@ -397,6 +391,27 @@
</p>
</section>
+ <section data-transition="none">
+ <h2>FOSDEM, 12 years ago...</h2>
+ <img src="images/Screenshot_FOSDEM_2014.webm.png" width="80%">
+ </section>
+
+ <section data-transition="none">
+ <h1>FOSDEM, 11 years ago</h1>
+ <img src="images/Screenshot_FOSDEM_2015.mp4.png" width="100%">
+ </section>
+
+ <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>according to https://reproducible-builds.org/who/projects/</h3>
+
+<p style="font-size: 100%">
+
+Alpine Linux, Apache Maven, Arch Linux, Baserock, Bitcoin Core, BitShares, Buildroot, Civil Infrastructure Platform, coreboot, Debian, ElectroBSD, F-Droid, FreeBSD, Freedesktop SDK, Fedora, GNU Guix, Go, In-toto, MirageOS, Monero, NetBSD, NixOS, OpenEmbedded, openSUSE, OpenWrt, openEuler, Qubes OS, SecureDrop, Symfony, Tails, Talos Linux, TREZOR, Tor Browser, Webconverger, Yocto Project, Trisquel GNU/Linux, rattler-build, IzzyOnDroid
+
+ </p>
+ </section>
+
+
<section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h1>Introduction</h1>
</section>
@@ -462,7 +477,7 @@
<section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h4>By 2025 Reproducible Builds has been widely understood:</h4>
+ <h4>By 2026 Reproducible Builds has been widely understood:</h4>
<ul>
<li>
<br><span class="fragment" style="font-size: 100%">https://reproducible-builds.org/resources/ <small>(incl. these slides)</small>
@@ -524,8 +539,9 @@
<li>2019 Marrakech</li>
<li>2022 Venice</li>
<li>2023/2024 Hamburg</li>
- <li class="fragment">2025 Vienna</li>
- </ul>
+ <li>2025 Vienna</li>
+ <li class="fragment">2026 Gothenburg</li>
+ </ul>
</section>
<section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
@@ -613,13 +629,12 @@ Warpforge.
<section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h3>Reproducible Builds for some parts of Debian are a reality today:</h3>
<ul>
- <span class="fragment">
- <li>reproducible docker/podman images: docker.debian.net</li>
- <li>reproducible live images: cdimage.debian.org</li>
- <li>individual packages, useful for both developers and some users. >95% of 37000 source packages build reproducibly by now</li>
- <li><code>mmdebstrap --variant=apt trixie</code></li>
+ <li class="fragment">reproducible docker/podman images: docker.debian.net</li>
+ <li class="fragment">reproducible live images: cdimage.debian.org</li>
+ <li class="fragment">individual packages, useful for both developers and some users</li>
+ <li class="fragment"><code>mmdebstrap --variant=apt trixie</code></li>
- </span>
+ <li class="fragment">debvm, though <code>!MR/45</code>
</li>
@@ -735,77 +750,68 @@ Warpforge.
<img src="images/riscv64_rdn.png">
</section>
- <section data-background="images/archlinux.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>Arch Linux 2015-2025</h3>
+ <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h2>missing</h2>
+ <h4><code>https://s390x.reproduce.debian.net</code></h4>
+ <h4 class="fragment"><code>unstable</code></h4>
+ <h4 class="fragment"><code>experimental</code></h4>
+ <h4 class="fragment"><code>-security</code></h4>
+ <h3 class="fragment"><code>forky</code></h4>
+ </section>
+
+ <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h2>reproduce.debian.net<br/> is <code>trixie</code> only atm</h2>
+ <img src="images/trixie.png" class="fragment">
+ </section>
+
+ <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h2><code>https://reproduce.debian.net</code></h2>
<ul>
- <li class="fragment">2015 - pacman records BUILDINFO</li>
- <li class="fragment">2017 - pacman S_D_E support & archlinux-repro</li>
- <li class="fragment">2019 - started archiving packages required for rebuilds</li>
- <li class="fragment">2020 - rebuilderd instance, [core] 86%</li>
- <li class="fragment">2024 - reproducible minimal container userland</li>
- <li class="fragment">2025 - 12% left to make reproducible (4 for minimal bootable install)</li>
+ <li>We are very happy to use the same tool for Debian as Archlinux, and recently Fedora too.<li>
+ <li class="fragment">However the Debian setup is still its infancy and scaling is more of an issue: 8 architectures instead of 1, 2 suites needed instead of 1 (and 3 once trixie has been released), and 3 times as many packages as Arch tests.</li>
+ <li class="fragment">https://github.com/fepitre/package-rebuilder from Frédéric Pierre also exists. We love rebuilderd, but we also love software diversity.</li>
</ul>
- </section>
- <section data-background="images/archlinux.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>https://gitlab.archlinux.org/archlinux/rebuilderd-website</h3>
- <img src="images/Screenshot_2024-11-15_Arch_Linux_Reproducible_Status.png">
- </section>
-
- <section data-background="images/archlinux.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>https://dashboards.archlinux.org/d/PKkRg-FGz/rebuilderd</h3>
- <img src="images/Screenshot_2025_31_01_Arch_Linux_Reproducible_Dashboard.png">
- </section>
+ </section>
+ <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h2><code>https://reproduce.debian.net</code></h2>
+ <h3>another frontend is possible:</h3>
+ <img src='images/reproduce.algiz.nu.png'>
+ </section>
- <section data-background="images/nixos.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>NixOS</h3>
- <ul>
- <span class="fragment"><li>https://luj.fr/blog/is-nixos-truly-reproducible.html - blog post by Julien Malka, summarizing his research article https://hal.science/hal-04913007.</li>
- <li>The article explores the proportion of bitwise reproducible packages in the Nix package repository and its evolution between 2017 and 2023.</li></span>
- <li class="fragment"><em>"Our most important finding is that the reproducibility rate in nixpkgs has increased steadily from 69% in 2017 to about 91% in April 2023."</em></li>
- </ul>
- </section>
- <section data-background="images/nixos.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>NixOS</h3>
- <ul>
- <li>Talk yesterday in the <em>Nix and NixOS</em> track:<br> https://fosdem.org/2025/schedule/event/fosdem-2025-4430-how-reproducible-is-nixos-/
- </ul>
- <img src="images/nixos-reproducibility-overall-absolute.png" style="height: 400px;">
- </section>
+ <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h2><code>https://reproduce.debian.net</code></h2>
+ <h1>more help much welcome!</h1>
+ <p class="fragment">Also please setup rebuilderd instances!<p>
+ <p class="fragment">Because do you really want to put all your trust in me???<p>
- <section data-background="images/freebsd.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>FreeBSD</h3>
- <ul>
- <li>Talk at FOSDEM 2016 by Baptiste Daroussin: Reproducible builds in FreeBSD packages</li>
- <li class="fragment">FreeBSD base system continously tested on jenkins.debian.net since 2015. Just as NetBSD is :)</li>
- <li> </li>
- <li> </li>
- <li> </li>
- <li> </li>
- </ul>
- </section>
+ </section>
- <section data-background="images/freebsd.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>FreeBSD</h3>
- <ul>
- <li>Talk at FOSDEM 2016 by Baptiste Daroussin: Reproducible builds in FreeBSD packages</li>
- <li>FreeBSD base system continously tested on tests.reproducible-builds.org since 2015. Just as NetBSD is :)</li>
- <li class="fragment">In 2016 there was WIP for reproducing ports and achieved 80%. And then this efford got stalled...</li>
- <li class="fragment">until now: https://freebsdfoundation.org/blog/zero-trust-builds-for-freebsd/</li>
- </ul>
- </section>
+ <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h2>The diff between theory and practice?</code></h2>
+ <h1 class="fragment">We soon will be more reproducible in practice than in theory ;p</h1>
+ </section>
+ <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>The diff between theory and practice today?</code></h3>
+ <h2>96.6% in CI</h2>
+ <h3>vs</h3>
+ <h2>96.54% on amd64.reproduce.d.n</h2>
+ <p class="fragment">and we've only been doing this for 10 months & the freeze...</p>
+ </section>
- <section data-background="images/freebsd.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
- <h3>FreeBSD</h3>
+ <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>Find out for yourself:</h3>
<ul>
- <li>the zero-trust build project is scheduled from jan-aug 2025 and centers on the freebsd build process, and in particular, release building. the primary goal of this work is to enable the entire release process to run without requiring root access, and that build artifacts build reproducibly – that is, that a third party can build bit-for-bit identical artifacts.
- </li>
- <li class="fragment">[this] is one of five initiatives that together are aimed at advancing zero trust builds, software bill of materials (sbom), ci/cd automation, security controls in ports and packages, and technical debt reduction.</li>
+ <li><code>sudo apt install debian-repro-status</code>
+ <li class="fragment"><code>debian-repro-status</code>
+ <li class="fragment"><code> INFO debian-repro-status > 60/2268 packages are not reproducible.</br>
+ INFO debian-repro-status > Your system is 97.35% reproducible.</code></li>
+ <li class="fragment">That is better in practice than in theory. :-D
</ul>
- </section>
+ </section>
<section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<h2>How to reach 100% in practice</h2>
@@ -823,10 +829,10 @@ Warpforge.
<h2>Debian policy</h2>
<ul>
<li>2017: packages <em>should</em> build reproducibly.</li>
- <li class="fragment">2025? reproducible packages <em>must not</em> regress.</li>
- <li class="fragment">2025? NEW packages <em>must</em> build reproducibly.</li>
+ <li class="fragment">2026? reproducible packages <em>must not</em> regress.</li>
+ <li class="fragment">2026? NEW packages <em>must</em> build reproducibly.</li>
<li class="fragment">2027? packages <em>must</em> build reproducibly.</li>
- <li class="fragment">In practice the release team will probaby enforce this before it becomes policy. ☺️ </li>
+ <li class="fragment">In practice the release team will enforce this before it becomes policy. ☺️ </li>
</ul>
</section>
@@ -918,6 +924,33 @@ Warpforge.
</table>
</section>
+
+ <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>and then came the MiniDebConf Hamburg 2025...</h3>
+ <ul>
+ <li>...and Paul (elbrus) and me talked about <code>forky</code>.
+ <img src="images/forky-toy-story-4.rhorizontal.w700.jpg" class="fragment">
+ </ul>
+ </section>
+
+ <section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>...so for forky...!</h3>
+ <ul>
+ <li>britney will be configured to not let unreproducible packages migrate to testing!
+ <h2 class="fragment">🥳 🤗 🫠 🥳 </h2>
+ <li class="fragment">with allowlists for <b>some</b> unreproducible packages...</li>
+ </ul>
+ </section>
+
+ <section data-background="images/debian_logo.png" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>switch tab</h2>
+ <ul>
+ <li>Show numbers on r.d.n....</li>
+ <li class="fragment">Show reasons on r.d.n....</li>
+ <li class="fragment">continue presentation</li>
+ </ul>
+ </section>
+
<section data-background="images/rb-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
<img src="images/ccc2014-13.png">
</section>
@@ -929,10 +962,12 @@ Warpforge.
Thank you
<br><small>… and all contributors out there!</small>
</h2>
+
<p>Any questions? 🤷</p>
<h4>
- #debian-reproducible on irc.oftc.net<br>
+ <small>Holger Levsen <holger at reproducible-builds.org><br>
+ #debian-reproducible on irc.oftc.net<br>
#reproducible-builds on irc.oftc.net<br>
rb-general at lists.reproducible-builds.org
</small>
@@ -940,6 +975,42 @@ Warpforge.
</section>
+ <!-- section data-background="images/minidebconfhh2026-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>
+ 22 unreproducible src packages out of the 1337 most popular
+ </h3>
+ <p style="font-size: 100%">
+
+ rdma-core jpeg-xl graphviz qtwebengine-opensource-src pipewire tracker colord nss qtbase-opensource-src grub2 libu2f-host apg libdmapsharing libjcat bluez vlc coinor-cgl lynx underscore gegl ffmpeg bind9
+ <p>
+ </section>
+
+ <section data-background="images/minidebconfhh2026-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>
+ 96 build-essential-depends unreproducible source packages (out of 5500)
+ </h3>
+ <p style="font-size: 77%">
+ maven-shared-utils rdma-core rustc php8.2 jpeg-xl subversion systemtap graphviz r-base pipewire pandas camlp-streams statsmodels colord chromium qt6-declarative nss qtbase-opensource-src python3.12 python3.13 cdi-api gdb pupnp pacemaker scim gcc-13-cross qemu efl bsh cxxtest codenarc fop jsoup hevea libnative-platform-java javaparser black pstoedit lucene4.10 gmetrics emoslib combblas node-function-bind gdcm xmlbeans yarl nbsphinx groovy fltk1.3 ruby-pygments.rb libapache-poi-java ldc doxygen ghc lombok h2database freetds jsch jboss-jdeparser2 dejagnu jts python-nacl servlet-api jaxb ocaml-topkg odc qtremoteobjects-everywhere-src mpich lucene8 secilc bluez vlc valgrind linux86 golang-golang-x-net coinor-cgl parallel lynx underscore asmtools rocm-hipamd libcamera nbconvert mypy petsc node-d3 qtconnectivity-opensource-src eckit eccodes frozenlist extlib emacs ffmpeg bind9 meson-python ipyparallel
+ <p>
+ </section>
+
+ <section data-background="images/minidebconfhh2026-logo.svg" data-background-size="10%" data-background-position="93% 9%" data-transition="none">
+ <h3>
+ image sources:
+ </h3>
+ <p>
+ <img src="images/lunar1.jpg" style="height: 220px; border-radius: 10px;">
+ <br>
+ https://mastodon.xyz/@mac_call/113448024657756100
+ </p>
+ <p>
+ <img src="images/lunar2.jpg" style="height: 220px; border-radius: 10px;">
+ <br>
+ https://pouet.chapril.org/@infothema/113459042400198201
+ </p>
+ </section -->
+
+
</div>
</div>
=====================================
2026-05-09-Reproducing-Debian-in-the-real-world/todo
=====================================
@@ -1,6 +1,20 @@
-sponsors wanted somewhere?
-mention guix
- suse
-add pkern and linus
+
+update
+
+
+
+debian
+ specs: rebuilderd
+ (DBs for 5 archs are 123G but 3.4G compressed)
+ specs: worker
+ update bugs and patches graphs
+
+ 2015 talk
+ reproducible.debian.net consisted of 14 jenkins jobs defined in 263 lines of yaml, 13 shell scripts making up 2049 loc, and 4 python scripts with 948 loc. (running on 1 computer i believe). and 81.7% of more than 17600 source packages where reproducible in CI.
+ "We hope reproducible builds will become the norm." - one of the closing slides of the 2015 talk
+ Future: Binary transparancy logs: public log of all software releases.
+ 2014 talk by lunar at fosdem
+ 2014 lunar found 62% reproducible packages out of >5000 tested.
+ to the thanks/funding slide: thanks to osuosl and codethink, but also ionos and all other sponsors!
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-presentations/-/compare/8bf0bc668f9f6e9daf55f72596756daff75023b6...37c6c75a536a7295701c8ac34fa707d90a0a2a48
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-presentations/-/compare/8bf0bc668f9f6e9daf55f72596756daff75023b6...37c6c75a536a7295701c8ac34fa707d90a0a2a48
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-commits/attachments/20260507/42f0c561/attachment.htm>
More information about the rb-commits
mailing list