> In short: It's hard for me to tell "what's left to do for real Debian (at > least > its required parts) to be reproducible?"
Hi, I don't know if i'm missing context on the "theory to practice"
aspect of it, but it appears that this is something we're trying to fix
using the debian rebuilder setup and the buildinfo archive:
https://buildinfo.debian.net/
The rebuilder will basically reproduce a package in distinct
infrastructure and post an attestation about this action. Here's our
repo:
https://salsa.debian.org/reproducible-builds/debian-rebuilder-setup/tree/integrate-srebuild
The idea longerm would be to enforce theshold signing on reproducible
packages using something akin to in-toto*:
https://in-toto.github.io/
I'll say there's something along this lines already on the works, but
it's not released yet.
I don't know how much this helps contextualize your question though...
Thanks,
-Santiago.
* (disclaimer, I'm the lead dev on in-toto...)
signature.asc
Description: PGP signature
_______________________________________________ [email protected] mailing list To change your subscription options, visit https://lists.reproducible-builds.org/listinfo/rb-general. To unsubscribe, send an email to [email protected].
