Package: ftp.debian.org Severity: wishlist User: [email protected] Usertags: archive
Hi! As part of the “reproducible builds” effort [1], we came up with the idea of a new control file, currently named “.buildinfo” .buildinfo files would capture from the build environment as much information as needed to reproduce the build. The file format and how it could be included in the archive is described on the wiki [2]. An exercise in summarizing the key points: * A .buildinfo file is generated for each build, and is considered unique for a source package, version, and architecture. A rebuild should always generate the same .buildinfo as the original build. * A .buildinfo contains many fields similar to .changes, and the list of all packages forming the build environment (build-deps, their deps, Essential:yes, build-essential, etc.) * .buildinfo would be distributed in the archive together with source and binary packages. * They would be accompanied by detached GnuPG signatures, so multiple parties (e.g. DD and buildd) could assert the production of similar binary packages from the same source and same environment. * The latter information can then be shown in the Packages index for each binary packages. * A tool will allow independent parties to rebuild binary packages from .buildinfo files in the archive. We wish .buildinfo files could become part of the Debian archive. For that to happen, we highly welcome your comments on the current specification, and advices regarding the next steps we could make. During our experiments, adding .buildinfo files to .changes had one unforeseen consequence. Packages that used to be “Architecture: all” are now “Architecture: all amd64” as .buildinfo are tied to a given build architecture. Except that it breaks lintian test suite, it is unclear if that's a problem at all, or if some changes should be made. Again, your input would be most welcome. [1]: https://wiki.debian.org/ReproducibleBuilds [2]: https://wiki.debian.org/ReproducibleBuilds/BuildinfoSpecification -- Lunar .''`. [email protected] : :Ⓐ : # apt-get install anarchism `. `'` `-
signature.asc
Description: Digital signature
