Verifying packages with Debian's ReproducibleBuilds

Identical Build

Conclusions

Thus far Debian's ReproducibleBuilds project is a success story: As of February 13, 2015, reproducible builds worked for 83.5 percent of all packages (Figure 2) [20]. The new build type will probably also be a release target for Debian 9 – all designed to make Debian that little bit more secure.

Figure 2: In February 2015, the number of packages that could be reproducibly built reached an interim high.

Infos

ReproducibleBuilds in Debian: https://wiki.debian.org/ReproducibleBuilds
OpenSSH bug: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-0083
Move on ReproducibleBuilds from 31C3: https://www.youtube.com/watch?v=5pAen7beYNc
Origins of ReproducibleBuilds: https://lists.debian.org/debian-devel/2007/09/msg00746.html
Tor using ReproducibleBuilds: https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise
Problems with ReproducibleBuilds: https://reproducible.debian.net/index_issues.html
Doxygen: http://www.stack.nl/~dimitri/doxygen/
Latex: http://www.latex-project.org
Problems with preprocessor macros in C++: https://wiki.debian.org/Reproducible-Builds/TimestampsFromCPPMacros
Enhanced toolchain: http://reproducible.alioth.debian.org/debian
Buildinfo specification: https://wiki.debian.org/ReproducibleBuilds/BuildinfoSpecification
Debian's Snapshot package archive: http://snapshot.debian.org
Pbuilder: http://pbuilder.alioth.debian.org
debbindiff: https://tracker.debian.org/pkg/debbindiff
Continuous integration platform: https://jenkins.debian.net/
Jenkins statistics: https://reproducible.debian.net/reproducible.html
Buildd: http://buildd.debian.org
Keynote at FOSDEM: http://ftp.heanet.ie/mirrors/fosdem-video/2015/main_track-miscellaneous/Stretching_out_for_trustworthy_reproducible_builds_by_Holger_and_Lunar.mp4
Trusting-Trust attacks: https://www.schneier.com/blog/archives/2006/01/countering_trus.html
Project status update from February 2015: https://lists.debian.org/debian-devel-announce/2015/02/msg00007.html

The Author

Daniel Stender http://www.danielstender.com/entwicklerblog/ has focused on Debian on the desktop since 2002. He officially maintains various packages pertaining to Python libraries, document analysis, OCR, and media production.

« Previous 1 2 3