5 ms·

Based on my reading of this Arch wiki page[0], it looks like this doesn't impact packages in the AUR. Does anyone who is more familiar with this know if that is

Based on my reading of this Arch wiki page[0], it looks like this doesn't impact packages in the AUR. Does anyone who is more familiar with this know if that is true? It appears that it does work for community packages though (see the bottom of this page[1]). [0] https://wiki.archlinux.org/index.php/Rebuilderd https://wiki.archlinux.org/index.php/Rebuilderd [1] https://wiki.archlinux.org/index.php/Rebuilderd#Syncing_packages_to_rebuild https://wiki.archlinux.org/index.php/Rebuilderd#Syncing_pack...

tomjakubowski 7y ago
AUR packages are source only so there's no binary package that is distributed to be verified.
- serf 7y ago
  that's only mostly true. take for example the aur package for MS fonts; https://aur.archlinux.org/packages/ttf-ms-fonts/ https://aur.archlinux.org/packages/ttf-ms-fonts/ all it does is download a ton of microsoft corefont executables to unpack. another example would be the proprietary driver packages, like the nvidia ones.
  - JeremyNT 7y ago
    You're describing what those AUR builds do not what they are. Reproducible builds are for artifacts that are... built. Plenty of AUR recipes download blobs and explode them, but the resulting xz package isn't actually hosted in the AUR. A tool like rebuilderd would only be relevant to the AUR in the case that somebody is publishing generated AUR packages to a repo for others to install without building them directly, and then you'd like to verify those.
  - banachtarski 7y ago
    proprietary drivers from nvidia are provided by the Arch mainline (core) though?
    - serf 7y ago
      right you are, i've been on beta for years and had forgotten. point still stands, aur does distribute executables once in awhile.
      - pritambaral 7y ago
        > aur does distribute executables once in awhile. The AUR doesn't distribute those executables; it distributes the instructions for the user (or some software working on behalf of the user) to go fetch the executables themselves. This is an important distinction, because the official Arch repositories _do_ distribute executables, directly to the user.
  - tomjakubowski 7y ago
    This is a question of the artifacts distributed as part of Arch Linux, the tar.xz packages. The idea is to be able to reproducibly build a package from source (where "source", yes, may include binary assets and blobs), and check that the copy you built matches what Arch distributes, byte for byte. This way, you know the packager hasn't introduced unexpected changes. Since end users build AUR packages themselves, there is nothing distributed, and nothing to verify.
  - gerdesj 7y ago
    I think of the AUR packages as more like ebuilds with fewer safety catches 8)
Foxboron 7y ago
>Based on my reading of this Arch wiki page[0], it looks like this doesn't impact packages in the AUR. Yes. AUR is excluded from reproducible builds because it only provides build scripts and not actual packages. There is nothing to reproduce. One surely could make a repo and compare results, but it would frankly be a bit futile considering the general package quality there.

tomjakubowski 7y ago

AUR packages are source only so there's no binary package that is distributed to be verified.

serf 7y ago
that's only mostly true. take for example the aur package for MS fonts; https://aur.archlinux.org/packages/ttf-ms-fonts/ https://aur.archlinux.org/packages/ttf-ms-fonts/ all it does is download a ton of microsoft corefont executables to unpack. another example would be the proprietary driver packages, like the nvidia ones.
- JeremyNT 7y ago
  You're describing what those AUR builds do not what they are. Reproducible builds are for artifacts that are... built. Plenty of AUR recipes download blobs and explode them, but the resulting xz package isn't actually hosted in the AUR. A tool like rebuilderd would only be relevant to the AUR in the case that somebody is publishing generated AUR packages to a repo for others to install without building them directly, and then you'd like to verify those.
- banachtarski 7y ago
  proprietary drivers from nvidia are provided by the Arch mainline (core) though?
  - serf 7y ago
    right you are, i've been on beta for years and had forgotten. point still stands, aur does distribute executables once in awhile.
    - pritambaral 7y ago
      > aur does distribute executables once in awhile. The AUR doesn't distribute those executables; it distributes the instructions for the user (or some software working on behalf of the user) to go fetch the executables themselves. This is an important distinction, because the official Arch repositories _do_ distribute executables, directly to the user.
- tomjakubowski 7y ago
  This is a question of the artifacts distributed as part of Arch Linux, the tar.xz packages. The idea is to be able to reproducibly build a package from source (where "source", yes, may include binary assets and blobs), and check that the copy you built matches what Arch distributes, byte for byte. This way, you know the packager hasn't introduced unexpected changes. Since end users build AUR packages themselves, there is nothing distributed, and nothing to verify.
- gerdesj 7y ago
  I think of the AUR packages as more like ebuilds with fewer safety catches 8)

Foxboron 7y ago

>Based on my reading of this Arch wiki page[0], it looks like this doesn't impact packages in the AUR. Yes. AUR is excluded from reproducible builds because it only provides build scripts and not actual packages. There is nothing to reproduce. One surely could make a repo and compare results, but it would frankly be a bit futile considering the general package quality there.