news
Debian 14 “Forky” to Ship with Reproducible Packages, LoongArch64 Support
Debian’s Paul Gevers reports that the decision was taken for Debian to ship reproducible packages, which means that if you take the same source code, the same build instructions, and the same environment, you can build a binary package that’s bit-for-bit identical every single time. This will be a requirement in Debian 14 “Forky,” and non-reproducible packages will be blocked.
Debian 14 “Forky” will also be the first Debian release to ship with native rollback, undo, redo, and history features for its default APT package manager. These highly anticipated features align Debian with Red Hat-based distros and were officially introduced in the APT 3.2 release.
The Register:
-
Debian 14 cracks down on unreproducible packages
About halfway through the Debian 14 “Forky” development process, its release team announced a new goal: deterministic package compilation.
The Debian project’s latest Bits from the release team newsletter has a goal which may not sound very big, but will mean significant extra effort in a direction that could prove to be a valuable extra security measure.
"Aided by the efforts of the Reproducible Builds project, we’ve decided it’s time to say that Debian must ship reproducible packages," wrote ReleaseTeam member Paul Gevers. "Since yesterday, we have enabled our migration software to block migration of new packages that can’t be reproduced or existing packages (in testing) that regress in reproducibility."
More here:
-
Debian to require reproducible builds
Paul Gevers has slipped an interesting bit of news into a "bits from the release team" message: [...]
-
In a Big Move to GNU/Linux Security, Debian Makes Reproducible Builds Mandatory
Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch.
Debian's release team has made reproducible builds a hard requirement for the Debian 14 "Forky" cycle. Since May 9, the project's migration software has blocked any package failing a reproducibility check from entering testing.
If a package already in testing breaks reproducibility later, it gets blocked too. Paul Gevers from the release team shared the news on the debian-devel-announce mailing list over the weekend.
A day later:
-
Linux distro Debian goes all in on reproducible software
"We have enabled our migration software to block migration of new packages that can't be reproduced."