[Rpm-maint] [rpm-software-management/rpm] Make rpm builds more reproducible (Discussion #2654)

[Zbigniew Jędrzejewski-Szmek]

> For rolling distributions were no consistent snapshot is used for building there is the need for an archive of all previous builds and a tool that selects the correct versions from the archive as the buildinfo says.

How is this handled in Debian? I know that they report certain reproducibility numbers for packages, but I thought that those are based on trying to rebuild the package in the test environment a few times and comparing the results. AFAIK, they don't/didn't actually try to rebuild packages from the archive, but maybe it's changed. I saw various discussions about servers that snapshot package versions, but I don't know if those cover all the versions of all packages that were event used to build packages that ended up in the archive.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/discussions/2654#discussioncomment-9063421
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/repo-discussions/2654/comments/9063421 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20240409/ded63fdc/attachment.html>