Demystifying Unreproducible Builds: What, Why, and How?
summary
Analysis of 18 million builds from Debian finds 16 root causes (vs prior 6) grouped into build, filesystem, memory, system. The study shows build path is the top root cause by affected packages while build timestamps report more issue occurrences. Crucial packages become reproducible faster but flip back more often; trivial packages stay reproducible longer once fixed. Two build-dependencies dominate: Devhelper correlates with ~85% reproducibility, pkg-config correlates with ~25% unreproducible builds, and GCC changes can force edits across 3,000+ packages.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:10Software supply chain risks
- 4:03Security measures limits
- 5:31Reproducible builds matter
- 6:14Study overview
- 8:21Time to reproducibility
- 10:47Root causes
- 14:42Fixing multiple causes
- 15:02Build dependencies impact
- 17:54Ecosystem factors
- 18:58Key takeaways
- 19:20Q&A
related talks
47mReproducible builds
40mReproducible Builds: Unexpected Benefits and Problems
42mThe Long Road to Reproducible Builds
45mWhat Makes A Build Reproducible?
42mSecurity and Productivity Pick Two with Reproducible Builds
26mReproducible Postgres
13mDon’t Trust, Verify. Reproducible Builds in Bitcoin
07mReproducible Builds