Looking for reproducible RPM building / rebuilding tooling

[Jelle van der Waa]

Hi Simon,

On 27/11/2025 12:37, Simon Mudd wrote:
> Hello all,
> 
> I bumped into a YouTube talk by Holger
> https://www.youtube.com/watch?v=afJEjSf1m2Q and found it interesting.
> 
> I've been trying to ensure that I could rebuild MySQL rpms (based
> on upstream Oracle provided src rpms) on different OS versions
> (RHEL/AlmaLinux/RockyLinux/OracleLinux) and on version 8, 9 and 10
> of the OS and have some tooling
> https://github.com/sjmudd/mysql-rpm-builder/ to do that, but am
> looking to improve this and was looking around but could not see
> any out of the box solutions.
> 
> Oracle provides the source for MySQL on
> https://github.com/mysql/mysql-server but binary rpms are not built
> from git but from the src rpms.  These src packages are not identical
> copies of the git src code.
> 
> Documentation on Oracle's exact build process does not exist and I
> found many situations where it was not actually possible to rebuild
> the rpms often due to missing references to part of the build
> environment (e.g. missing rpm dependencies and no references to
> repos where those packages were located.)
> 
> I have sometimes also wanted to patch the source based on a
> reproducible "base" build and that is something that my current
> tooling now allows for.
> 
> Additionally at least in RPM world even supposedly "similar"/"identical"
> distributions like RHEL / Fedora / OracleLinux / Rocky Linux /
> AlmaLinux have different (but usually compatible) external repos
> which may need referencing and this can make the process of ensuring
> builds are reproducible harder as some customisation is required
> to handle this.
> 
> So having bumped into this list I was curious if others know of any
> better tooling for being able to consistently rebuild rpms from their
> src rpm packages.

For Fedora there is fedora-repro-build, but it is specifically made to 
work with koji. [1] Koji is Fedora's (CentOS) build service and the tool 
is build around getting the build information from koji and grabbing the 
packages from there to reproduce a provided package.

What might be interesting is that mock apparently supports "hermetic 
builds" which might be interesting to try out to reproduce a package 
with. [2]

[1] https://github.com/keszybz/fedora-repro
[2] 
https://rpm-software-management.github.io/mock/feature-hermetic-builds.html