RBOS / reproducible-openSUSE

[Bernhard M. Wiedemann]

On 25/02/2025 13.34, James Addison wrote:
> Hi Bernhard,
> 
> On Tue, 18 Feb 2025 at 12:22, Bernhard M. Wiedemann via rb-general
> <rb-general at lists.reproducible-builds.org> wrote:
>> [ ... snip ... ]
>> I have some good news to share about my small openSUSE fork project
>> https://news.opensuse.org/2025/02/18/rbos-project-hits-milestone/
>> that was sponsored by a grant from NLnet.
> 
> Many congratulations on building a 100% bit-for-bit reproducible Linux
> distribution!

Thanks.

> I'd been preparing to ask whether it's possible to uniquely identify
> the resulting distro build -- however, if I understand correctly, the
> pbuild process already does that[1], by emitting a
> checksum-of-checksums of the (locale-agnostically) sorted RPM
> packages?

That is not part of pbuild but my wrapper script around it:
https://build.opensuse.org/projects/home:bmwiedemann:reproducible:distribution:ring0/packages/000pbuildconf/files/build.sh
that calls sha256sums

to do exactly that.

Via the sha256sums.src there is also an ID of the source files.
So we have a bijective (one-to-one) mapping for srchash => binhash


With the current split of ring0 and ring1, it is a bit less nice, 
because they provide toolchain packages for the other, that is not part 
of the hash input atm.


Ciao
Bernhard M.