The rebootstrap is done because unofficial ports build servers usually are not owned or run by the Debian project, but by the porting teams themselves, who coul

The rebootstrap is done because unofficial ports build servers usually are not owned or run by the Debian project, but by the porting teams themselves, who could be and often are random people who are not yet Debian members. So we don't necessarily want to use all of those .debs because they might not be rebuildable, or they might have artefacts from whatever hacky bootstrap process the first build used. The bootstrap process is a QA strategy to have more trust in the resulting binary packages. Longer term we want all new ports to be cross-built from an existing architecture, but we don't have cross-buildds yet. The rebootstrap tool is a work-in-progress QA tool for making cross-building bootstrap for new arches a viable strategy. https://wiki.debian.org/HelmutGrohne/rebootstrap https://wiki.debian.org/HelmutGrohne/rebootstrap https://wiki.debian.org/DebianBootstrap https://wiki.debian.org/DebianBootstrap https://crossqa.debian.net/ https://crossqa.debian.net/ https://wiki.debian.org/PortsDocs/New https://wiki.debian.org/PortsDocs/New Even longer term, we should do a bootstrap of all architectures from scratch using the approach of Guix, Bootstrappable Builds and Reproducible Builds; start with ~500 bytes of hand-written machine code plus all the source code and build enough to get a build server up, then go from there. https://bootstrappable.org/ https://bootstrappable.org/ https://reproducible-builds.org/ https://reproducible-builds.org/ https://www.aikidev.net/~vagrant/talks/2023/fossy/Breaking_the_Chains_of_Trusting_Trust.pdf https://www.aikidev.net/~vagrant/talks/2023/fossy/Breaking_t...