How could we accelerate *deployment* of verified reproducible builds?

[David A. Wheeler]

> On Jan 30, 2021, at 7:22 AM, Holger Levsen <holger at layer-acht.org> wrote:
> 
> On Fri, Jan 29, 2021 at 05:39:01PM -0500, David A. Wheeler wrote:
>> What would be especially helpful for accelerating deployment of verified reproducible builds in a few key places? E.g., what tools, infrastructure, people paid to do XYZ?
> 
> first, having verified reproducible builds! then, we can deploy them.

Technically correct, the best kind of correct :-). And to be fair, there *are* some reproducible builds (as others have noted).

But I want to see them accelerated into more key places. An unfair counter statement could be “you’ve been at this a while, why aren’t you done?”. I think that’s unfair because it’s not so easy; there are many little things that have to be done (timestamps set, collections forced into specific orders, etc.). But what would it take to accelerate things?

--- David A. Wheeler