4 ms·

NetBSD has fully reproducible builds https://blog.netbsd.org/tnf/entry/netbsd_fully_reproducible_builds https://blog.netbsd.org/tnf/entry/netbsd_fully_reproduci

• foobarbazetc 8y ago
  The scope here is much larger as it’s every package in the Debian distro, not just the base system.
  • cat199 8y ago
    and pkgsrc has bulk package builds. same pkgsrc checkout + reproducable base => essentially reproducable full package builds. yes, some people will find some niggling way to make this not true because the binaries may be somehow altered due to timestamps, yadda, but for all practical purposes w/r/t the actual code and actual executables generated, this is true, and has been true for essentially the entire existance of bsd derivitaves using ports systems (1996).
    • lomnakkus 8y ago
      > same pkgsrc checkout + reproducable base => essentially reproducable full package builds. I would be truly surpised if that were the case. Are there no packages in pkgsrc which embed, e.g. timestamps, or even download things while building[1]? [1] JDK packages are a typical culprit in this type of situation because Oracle JDK requires an "accept license" prompt. > es, some people will find some niggling way to make this not true because the binaries may be somehow altered due to timestamps, yadda, but for all practical purposes w/r/t the actual code and actual executables generated, this is true, and has been true for essentially the entire existance of bsd derivitaves using ports systems (1996). Oh, so you're coopting "essentially reproducable" to mean "not reproducible". Ok then. "Reproducible builds" is about verification and isn't just about "close enough".
    • foobarbazetc 8y ago
      Did you... read the article?