Trixie 13.2 images not reproducible (Was: Are trixie 13.2 live images reproducible? How?)

[Roland Clobus]

Hello Simon, lists,

On 19/11/2025 22:50, Simon Josefsson wrote on debian-live:
> Any pointers to scripts that reproduce them?  If not, did anyone analyze
> what the difference is?

I just did an analysis of the standard image.

You can rebuild the official images with [1] (which you already know). I 
updated the information to mention the Trixie 13.2 point release.

Unfortunately, the locally built image is not identical to the official 
image. Fortunately, the differences are trivial and not affecting the 
main functionality of the live images (the squashfs file).

The differences are:
* /boot/grub/splash.png, /isolinux/splash.png -> The official image 
contains the text 'Debian 13', whereas the locally built image contains 
'Debian'. I'll need to adjust the rebuilder script to use the same boot 
image as in the official image. I'll probably manage to do so before the 
13.3 point release.
* /firmware/dep11/firmware-intel-sound.patterns, 
firmware/dep11/firmware-sof-signed.patterns -> Small differences in the 
pattern files. Most probably something of the kernel from the host leaks 
into the generated images. More investigation required.
* Due to the slightly different sizes of the files above, the output of 
'isoinfo' shows a lot of differences, but they will become identical 
after the 4 files above have been made reproducible.

With kind regards,
Roland Clobus

[1] https://wiki.debian.org/ReproducibleInstalls/LiveImages
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.reproducible-builds.org/pipermail/rb-general/attachments/20251122/d35ecbf2/attachment.sig>