<![CDATA["Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch."]]>"Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch."

https://itsfoss.com/news/debian-makes-reproducible-builds-mandatory/

]]>https://forum.fedi.dk/topic/7d439223-1e49-4714-88d9-5f764a87c86e/packages-that-can-t-be-rebuilt-byte-for-byte-are-now-blocked-from-entering-debian-s-testing-branch.RSS for NodeWed, 13 May 2026 16:08:02 GMTWed, 13 May 2026 08:49:24 GMT60<![CDATA[Reply to "Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." on Wed, 13 May 2026 12:48:25 GMT]]>@Pol @bagder @gonzo_askold @orpach.neocities.org indeed, "replayable" and "hermetic" are better terms for what Nix provides. Some of the bitwise reproducibility of nixpkgs comes from rigorously defining all build inputs, various patches we apply and default build settings we default to. But the brunt of the work is the massive and steller upstream work of https://reproducible-builds.org/, without which nixpkgs would not even be close to bitwise reproducible

]]>https://forum.fedi.dk/post/https://snabelen.no/users/pbsds/statuses/116567343486096777https://forum.fedi.dk/post/https://snabelen.no/users/pbsds/statuses/116567343486096777Wed, 13 May 2026 12:48:25 GMT<![CDATA[Reply to "Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." on Wed, 13 May 2026 12:35:09 GMT]]>@bagder @gonzo_askold @orpach.neocities.org Indeed, Nix greatly increases the chances of producing reproducible packages by controlling the build environment.

That said, it does not magically make the final artefact reproducible. There can still be sources of non-determinism, and we try to track them down as much as possible.

So far, things are going well! 🙂

]]>https://forum.fedi.dk/post/https://mathstodon.xyz/users/Pol/statuses/116567291268770567https://forum.fedi.dk/post/https://mathstodon.xyz/users/Pol/statuses/116567291268770567Wed, 13 May 2026 12:35:09 GMT<![CDATA[Reply to "Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." on Wed, 13 May 2026 11:38:10 GMT]]>@bagder Wow, that's awesome! Does anyone know if Ubuntu also will force reproducible builds considering that Ubuntu is based on Debian?

]]>https://forum.fedi.dk/post/https://mastodon.social/users/harmone/statuses/116567067198657412https://forum.fedi.dk/post/https://mastodon.social/users/harmone/statuses/116567067198657412Wed, 13 May 2026 11:38:10 GMT<![CDATA[Reply to "Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." on Wed, 13 May 2026 11:35:17 GMT]]>@bagder

Does this mean derivatives like Devuan automatically do this too?

]]>https://forum.fedi.dk/post/https://todon.nl/ap/users/116512023332271913/statuses/116567055887108431https://forum.fedi.dk/post/https://todon.nl/ap/users/116512023332271913/statuses/116567055887108431Wed, 13 May 2026 11:35:17 GMT<![CDATA[Reply to "Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." on Wed, 13 May 2026 11:20:25 GMT]]>@bagder this is also what fdroid does on Android i i think

]]>https://forum.fedi.dk/post/https://mastodon.social/users/andreasio/statuses/116566997418955664https://forum.fedi.dk/post/https://mastodon.social/users/andreasio/statuses/116566997418955664Wed, 13 May 2026 11:20:25 GMT<![CDATA[Reply to "Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." on Wed, 13 May 2026 11:11:22 GMT]]>@gonzo_askold In fact and others are reproductible too.
You can visit https://reproducible-builds.org/ to have an idea. When I worked in administration, we have a server with window NT to install via network on 200 same machines.

]]>https://forum.fedi.dk/post/https://mastodon.social/users/domdel/statuses/116566961849872203https://forum.fedi.dk/post/https://mastodon.social/users/domdel/statuses/116566961849872203Wed, 13 May 2026 11:11:22 GMT<![CDATA[Reply to "Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." on Wed, 13 May 2026 11:03:45 GMT]]>@bagder idk what would be practical differences between these two systems and how one or the other would be more secure against supply chain attacks or other mitms

would be pretty interested in some reference materials

]]>https://forum.fedi.dk/post/https://mastodon.social/users/gonzo_askold/statuses/116566931913847350https://forum.fedi.dk/post/https://mastodon.social/users/gonzo_askold/statuses/116566931913847350Wed, 13 May 2026 11:03:45 GMT<![CDATA[Reply to "Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." on Wed, 13 May 2026 11:03:42 GMT]]>@gonzo_askold: this isn't true, as some builds embed things like the timestamp and build hostname in the artifacts. Nix sets some notion of the timestamp to epoch to account for this, but cannot fix every impurity everywhere (maven builds are notoriously finnicky, for instance).

Nix is great at this, but somewhat suffers from embracing the package without submitting the changes it makes to the package upstream. Because nix is so flexible (and doesn't always have the pull that Debian does with packagers), i believe nix has been less influential here than you would hope.

This change from Debian is awesome as we will all benefit from the fixes.

]]>https://forum.fedi.dk/post/https://tilde.zone/users/BryanBennett/statuses/116566931711105716https://forum.fedi.dk/post/https://tilde.zone/users/BryanBennett/statuses/116566931711105716Wed, 13 May 2026 11:03:42 GMT<![CDATA[Reply to "Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." on Wed, 13 May 2026 10:58:30 GMT]]>@gonzo_askold I'm only pointing out the difference, I'm not suggesting nix did anything bad or wrong.

]]>https://forum.fedi.dk/post/https://mastodon.social/users/bagder/statuses/116566911222050563https://forum.fedi.dk/post/https://mastodon.social/users/bagder/statuses/116566911222050563Wed, 13 May 2026 10:58:30 GMT<![CDATA[Reply to "Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." on Wed, 13 May 2026 10:58:19 GMT]]>@gonzo_askold @bagder sadly, that is not the case.
There are many corner cases, but the simplest example is "yes all your dependencies are reproducible, but you decide to `cat /dev/random > $PREFIX/my-seed`" or whatever.

]]>https://forum.fedi.dk/post/https://mastodon.tetaneutral.net/users/nim/statuses/116566910564674202https://forum.fedi.dk/post/https://mastodon.tetaneutral.net/users/nim/statuses/116566910564674202Wed, 13 May 2026 10:58:19 GMT<![CDATA[Reply to "Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." on Wed, 13 May 2026 10:58:11 GMT]]>@domdel maybe I want there at that time

quick search of "net install reproducible" yields only dotnet stuff

]]>https://forum.fedi.dk/post/https://mastodon.social/users/gonzo_askold/statuses/116566910030755116https://forum.fedi.dk/post/https://mastodon.social/users/gonzo_askold/statuses/116566910030755116Wed, 13 May 2026 10:58:11 GMT<![CDATA[Reply to "Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." on Wed, 13 May 2026 10:55:24 GMT]]>@gonzo_askold @orpach.neocities.org @bagder About reprocductibility, net install was there before ...

]]>https://forum.fedi.dk/post/https://mastodon.social/users/domdel/statuses/116566899057818913https://forum.fedi.dk/post/https://mastodon.social/users/domdel/statuses/116566899057818913Wed, 13 May 2026 10:55:24 GMT<![CDATA[Reply to "Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." on Wed, 13 May 2026 10:53:42 GMT]]>@bagder

I'm not that knowledgeable about inside workings, but in theory (in my head) hashing all inputs does equate to byte-to-byte reproducibility, even if previous steps in the build process weren't written specifically to be reproduced

]]>https://forum.fedi.dk/post/https://mastodon.social/users/gonzo_askold/statuses/116566892356435796https://forum.fedi.dk/post/https://mastodon.social/users/gonzo_askold/statuses/116566892356435796Wed, 13 May 2026 10:53:42 GMT<![CDATA[Reply to "Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." on Wed, 13 May 2026 10:51:16 GMT]]>@bagder @gonzo_askold @orpach.neocities.org yes, https://reproducible-builds.org/ also apply to nix : https://reproducible.nixos.org/
there was 100% on minimal iso in december, but there is no hard constraint on the whole 100k+ package set from nixkpgs

]]>https://forum.fedi.dk/post/https://mastodon.tetaneutral.net/users/nim/statuses/116566882803264595https://forum.fedi.dk/post/https://mastodon.tetaneutral.net/users/nim/statuses/116566882803264595Wed, 13 May 2026 10:51:16 GMT<![CDATA[Reply to "Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." on Wed, 13 May 2026 10:47:45 GMT]]>@bagder it’s been 3 days and your post is still trending… what a great motto.”

]]>https://forum.fedi.dk/post/https://mastodon.social/users/seharinsights/statuses/116566869009342672https://forum.fedi.dk/post/https://mastodon.social/users/seharinsights/statuses/116566869009342672Wed, 13 May 2026 10:47:45 GMT<![CDATA[Reply to "Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." on Wed, 13 May 2026 10:47:02 GMT]]>@gonzo_askold @orpach.neocities.org sure, but nix has still included packages that not in themselves were done reproducible I'm pretty sure.

]]>https://forum.fedi.dk/post/https://mastodon.social/users/bagder/statuses/116566866178233105https://forum.fedi.dk/post/https://mastodon.social/users/bagder/statuses/116566866178233105Wed, 13 May 2026 10:47:02 GMT<![CDATA[Reply to "Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." on Wed, 13 May 2026 10:23:20 GMT]]>@orpach.neocities.org @bagder

is somewhat of pioneer in the space of reproducible builds and is 20 years old

]]>https://forum.fedi.dk/post/https://mastodon.social/users/gonzo_askold/statuses/116566772985473139https://forum.fedi.dk/post/https://mastodon.social/users/gonzo_askold/statuses/116566772985473139Wed, 13 May 2026 10:23:20 GMT