[Git][reproducible-builds/reproducible-website][master] gothenburg: Add d2-buildinfrastructure.md

[Bernhard M. Wiedemann (@bmwiedemann-guest)]

Bernhard M. Wiedemann pushed to branch master at Reproducible Builds / reproducible-website


Commits:
4c09b9b6 by Bernhard M. Wiedemann at 2026-09-25T10:17:55+02:00
gothenburg: Add d2-buildinfrastructure.md

- - - - -


1 changed file:

- + _events/gothenburg2026/agenda/d2-buildinfrastructure.md


Changes:

=====================================
_events/gothenburg2026/agenda/d2-buildinfrastructure.md
=====================================
@@ -0,0 +1,30 @@
+Improve serving and format of buildinfo files
+
+- can we include hashes of build dependencies in buildinfo files?
+  - there will be a discussion with the dpkg maintainer.
+  - would be nice for to have insight Debian but just an optimization
+  - required in a multiple distribution setup
+
+- how to integrate the buildinfo files into the Debian archive
+  - keep buildinfo files in distro specific archives
+  - integrate them into the normal Debian archive pool
+
+- Add a pointer to the bulidinfo file to the Packages file
+
+- Let dak check if the hashes in the buildinfo file matches the uploaded .deb
+  - also syntax check, source name, version, date
+  - make sure that all used build dependency package version are also in the archive
+
+- Should dak check that buildinfos are signed?
+  - already done via the .changes file
+
+- Should dak refuse uploads without a buildinfo file?
+
+- What is the attack vector of a malicious buildinfo file?
+  - For now we don't care
+
+- Still need to look into transparency logs for buildinfo files
+
+- We want to construct the chain of reproducible packages
+  - make sure that all build dependency of a package are reproducible
+  - how to bootstrap?



View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/4c09b9b6100a18208fe7b4f1aaab991a0736ba9e

-- 
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/4c09b9b6100a18208fe7b4f1aaab991a0736ba9e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-commits/attachments/20260925/d7f8c3e4/attachment.htm>