Reproducible Builds, the first ten years
summary
Project documents a decade of practical wins and remaining debt for bit-for-bit verification of binaries. Key inventions are SOURCE_DATE_EPOCH and buildinfo files to remove timestamp variance, the comparison tool diffoscope, and the bootstrapping effort to rebuild GCC from minimal seeds. Debian efforts touch ~30,000 source packages, 3,000 reproducibility patches merged and reproducible rate rising from ~60% in 2014 to roughly 95% today. Deployments include Tails and F‑Droid enforcing reproducible releases and Docker/Live images becoming reproducible.
AI-written summary · about
chapters (32)
- 0:00Reproducible Builds intro
- 1:38What are Reproducible Builds
- 3:35Binary supply chain problems
- 5:45Reproducible Builds definition
- 7:10Supply chain attack examples
- 9:39Bitcoin and Reproducible Builds
- 11:24Birth of modern efforts
- 12:27Early skepticism and challenges
- 13:55Historical roots of reproducibility
- 15:18diffoscope for binary comparison
- 17:25Debian Reproducible progress
- 19:118 years of progress and challenges
- 20:37Reproducible Builds Summits
- 21:38Bootstrappable project issues
- 22:45Common unreproducibility causes
- 24:09Fixing build path and timestamps
- 25:58Rebuilders and transparency efforts
- 27:25Industry standards and policies
- 29:12Tails OS case study
- 30:25Other projects adopting RB
- 32:12Enforcing reproducibility challenges
- 33:57Mistakes and best practices
- 35:47Frustration and progress
- 37:12Debian’s full reproducibility
- 38:34Rebuilding infrastructure debt
- 41:43Live images and Docker reproducibility
- 43:31Policy changes and goals
- 44:58Summary and contributions
- 45:19Q&A: Dip in reproducibility
- 46:24Q&A: Future and security
- 48:34Q&A: Android and long-term RB
- 49:24Q&A: Funding and contributions
related talks
47mReproducible builds
34mReproducible Builds in Fedora
42mBinary Reproducible Builds with Docker
42mSecurity and Productivity Pick Two with Reproducible Builds
28mBuilding reproducible Python applications for secured environments
30mBringing Continuous Delivery to Open Source
21mReproducible Builds and sstate over CDN - Update on AGL's Infra and CIAT
32mSoftware Supply Chain with the Yocto Project