3 ms·

While we are bragging, stagex was the first to hit 100% full source bootstrapped deterministic and hermetic builds last year and the first to make multiple sign

by lrvick 5mo ago

While we are bragging, stagex was the first to hit 100% full source bootstrapped deterministic and hermetic builds last year and the first to make multiple signed reproductions by different maintainers on their own hardware mandatory for every release. Debian has come along way, but when Debian says reproducible they mean they grab third party binaries to build theirs. When we say reproducible we mean 100% bootstrapped from source code all the way through the entire software supply chain. We think that distinction matters. https://stagex.tools https://stagex.tools

PunchyHamster 5mo ago
That distro has smaller codebase than Debian Installer.
nrvn 5mo ago
This! Unfortunately, the term “reproducible” can be interpreted in many ways because there is no strict and complete definition. People and projects bend it to their liking. Your approach is correct. https://www.bootstrappable.org/ https://www.bootstrappable.org/
- deleted 5mo ago
  [deleted]
deknos 5mo ago
newcomers will always have it much easier. also guix i think also reached this. also, stagex and others probably profited QUITE A LOT from the debian efforts, because they started to go upstream and talking to developers.. just arch linux profited from debian maintainers a decade before that an debian people asking upstream to improve...
- lrvick 5mo ago
  Guix did a full source bootstrap first, credit where well due, but it does not apply to their whole tree. E.g haskell is bootstrapped with a binary, qemu includes binary firmware blobs, etc. Guix is not fully bootstrapped or reproducible. To your point though, the incomplete efforts of many other distros absolutely accelerated us.
  - deknos 5mo ago
    that depends though, which channel you choose. And their efforts for stage0 and such also increased the possibility for all. Yay for Free software and Opensource! we all benefit! :)
matttttttttttt 5mo ago
Stage -1: `hexdump`, `xxd`, or whatever you use to write files to your filesystem.

by lrvick 5mo ago

PunchyHamster 5mo ago

That distro has smaller codebase than Debian Installer.

nrvn 5mo ago

This! Unfortunately, the term “reproducible” can be interpreted in many ways because there is no strict and complete definition. People and projects bend it to their liking. Your approach is correct. https://www.bootstrappable.org/ https://www.bootstrappable.org/

deleted 5mo ago
[deleted]

deknos 5mo ago

newcomers will always have it much easier. also guix i think also reached this. also, stagex and others probably profited QUITE A LOT from the debian efforts, because they started to go upstream and talking to developers.. just arch linux profited from debian maintainers a decade before that an debian people asking upstream to improve...

lrvick 5mo ago
Guix did a full source bootstrap first, credit where well due, but it does not apply to their whole tree. E.g haskell is bootstrapped with a binary, qemu includes binary firmware blobs, etc. Guix is not fully bootstrapped or reproducible. To your point though, the incomplete efforts of many other distros absolutely accelerated us.
- deknos 5mo ago
  that depends though, which channel you choose. And their efforts for stage0 and such also increased the possibility for all. Yay for Free software and Opensource! we all benefit! :)

matttttttttttt 5mo ago

Stage -1: `hexdump`, `xxd`, or whatever you use to write files to your filesystem.