
Reproducible Tails builds - Santosh83
https://tails.boum.org/news/reproducible_Tails/index.en.html
======
bringtheaction
> When we generate a Tails ISO image, our source code and the Debian packages
> we include are assembled into a binary ISO image, much like when the
> ingredients of the recipe are mixed together, one obtains the meal.

Tails being based on Debian and Debian having put in a lot of effort in
reproducible builds I guess it's thanks to Debian (and by that I mean everyone
contributing to Debian) it was feasible for them to do this.

Happy to hear about this. All distros ought to strive for reproducible builds.

------
chaz6
This is a big step forward for free software and another great reason why open
source is better than closed.

------
madez
I can't fathom why compilers include so much metadata in builds and don't have
a flag to disable it.

Why isn't there an option to completely leave out the build path, timestamps
and anything else that isn't necessary for the program to function?

Then, besides having different compilers or versions thereof, reproducible
builds would be a triviality.

Am I right in assuming that the developers of GCC have political reasons for
it?

~~~
jwilk
I don't know why you blame GCC. It doesn't stuff any such metadata into
binaries on its own, but because it was asked to do so. Also, I'm pretty sure
most reproducibility issues has nothing to do with a C compiler anyway.

~~~
taeric
The parts of the compiler that kill reproducibility, I had thought, were the
optimizations. Which can be a non-deterministic search of an optimization
space nowdays.

~~~
madez
Even if a compiler used "random" inputs for profiling, they could come from a
deterministic pseudo random number generator that returns the same result on
each compilation.

~~~
taeric
Yeah, that is what I guessed down thread. I just latched onto "non-
deterministic."

