A small step for debian, giant leap for mankind.
As someone who recently spent a lot of time on making a large C++ program entirely reproducible on 4 different OS’es, one cannot understate just how many tiny details matter here.
Debian must ship reproducible packages
11–20 of 178 posts
Re: Debian must ship reproducible packages
#12zero improvement on end-user experience. does not solve supply chain issues, debian package will reproducabily contain the malware from upstream.
If you find yourself holding opinions of the kind: "If it can't be made perfect, it shouldn't be changed at all?" you may want to consider that most things that work well today were incrementally improved.
Reproducable builds are not solving all issues as you rightly observed, but they can be a stepping stone (or even a pre-condition) for further measures.
Re: Debian must ship reproducible packages
#13zero improvement on end-user experience. does not solve supply chain issues, debian package will reproducabily contain the malware from upstream.
> zero improvement on end-user experience. Maybe not by itself, but it does allow for the ecosystem to be audited, in a way that ultimately benefits the end-user. It really is an important part of a healthy supply chain.
[flagged]
Re: Debian must ship reproducible packages
#14Good thing. NetBSD has fully reproductible build since 2017. https://blog.netbsd.org/tnf/entry/netbsd_fully_reproducible_...
Re: Debian must ship reproducible packages
#15Debian, like any other legacy distro, mush became declarative, because the '80s model of manual deploy and the absurd pain of D/I and Preseed must end.
Re: Debian must ship reproducible packages
#16zero improvement on end-user experience. does not solve supply chain issues, debian package will reproducabily contain the malware from upstream.
It does not solve all supply chain issues, it do solve some supply chain issues. Not being able to see if the source code shipped is the same as been used for creating the binary is scary
Has there been a single publicly known attack that would have been prevented by this?
Re: Debian must ship reproducible packages
#17Good thing. NetBSD has fully reproductible build since 2017. https://blog.netbsd.org/tnf/entry/netbsd_fully_reproducible_...
As pointed in your link, NetBSD achieved this with some help from Debian. If I understand correctly, it's not that NetBSD tried harder, it's that their problem was easier: fewer packages which change less (they still use CVS, "stability" is an understatement!).
BTW, most Debian packages have reproducible builds. Those which have not (I'd say 5%) are shown in orange in the graph there: https://wiki.debian.org/ReproducibleBuilds
Re: Debian must ship reproducible packages
#18Earlier quoted context omitted.
> zero improvement on end-user experience. Maybe not by itself, but it does allow for the ecosystem to be audited, in a way that ultimately benefits the end-user. It really is an important part of a healthy supply chain.
[flagged]
While taking no stance on your statement, I think “fewer” works better in this context than “less”.
Re: Debian must ship reproducible packages
#19A great milestone, congrats Debian on taking a stance and holding high standards for yourself, especially in the current era.
Re: Debian must ship reproducible packages
#20Earlier quoted context omitted.
Debian has had a better "software supply chain" posture than any other player in the ecosystem since before the turn of the century. While we all face the risk of malware from upstream, Debian is the least at risk of being affected by it. See for example the stream of issues from npm et al. None of it has affected Debian.
> for example the stream of issues from npm et al. Curious, what distros where affected by npm supply chain attacks?
It's npm that's affected, therefore it's not even considered when choosing language/ecosystem for writing distro tools. You'll find no sane distro writing package manager in javascript precisely to avoid this joke of a supply chain.