[rb-general] reproducible .debs outside of the Debian archive

[HW42]

Hi,

Qubes has, like a bunch of other projects, an own apt repo.

Thanks to the work of the Debian reproducible builds project it's in the
most cases pretty easy to get the packages reproducible. But to get
"real" reproducible builds you need to record the required parts of the
build environment (the patched dpkg does this already by creating a
.buildinfo file) and the user needs to be able to reproduce the
environment (the srebuild-script is still WIP).

But this also requires to archive all source and binary packages and the
.buildinfo files. Debian has snapshot.debian.org for this (the
.buildinfo support is still WIP).

So I'm interested what you recommend for this? Running an own
instance of the snapshot.d.o software? Keep all versions in one repo?
What about the .buildinfo files?

HW42

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: OpenPGP digital signature
URL: <http://lists.reproducible-builds.org/pipermail/rb-general/attachments/20160123/748acfa9/attachment.sig>