Reproducible builds enable anyone to reproduce bit by bit identical binary packages from a given source, so that anyone can verify that a given binary derived from the source it was said to be derived. There is more information about reproducible builds on the Debian wiki and on https://reproducible-builds.org. These pages explain in more depth why this is useful, what common issues exist and which workarounds and solutions are known.
Reproducible Arch Linux is an effort to apply this to Arch Linux. Thus Arch Linux packages are build twice, with a few variations added and then the resulting packages from the two builds are compared using diffoscope. Please note that this is still at an early stage. Also there are more variations expected to be seen in the wild. Missing bits for testing Arch Linux:
- cross references to Debian notes - and having Arch Linux specific notes.
Missing bits for Arch Linux:
- code needs to be written to compare the packages built twice here against newly built packages from the Official Arch Linux repositories.
- user tools, for users to verify all of this easily.
If you want to help out or discuss reproducible builds in Arch Linux, please join #archlinux-reproducible on freenode.
| repository | all source packages | reproducible | unreproducible | failing to build | in depwait state | download problems | blacklisted | unknown state |
|---|---|---|---|---|---|---|---|---|
| core | 200 | 187 (93.5%) | 5 (2.5%) | 7 (3.5%) | 0 | 1 (.5%) | 0 | 0 |
| extra | 11315 | 9068 (80.1%) | 674 (5.9%) | 1476 (13.0%) | 9 (0%) | 68 (.6%) | 0 | 41 (.3%) |
| multilib | 259 | 233 (89.9%) | 4 (1.5%) | 12 (4.6%) | 1 (.3%) | 8 (3.0%) | 0 | 1 (.3%) |
| all combined | 11774 | 9488 (80.5%) | 683 (5.8%) | 1495 (12.6%) | 10 (0%) | 77 (.6%) | 0 | 42 (.3%) |
( recent builds, currently scheduled )
| variation | first build | second build | |
|---|---|---|---|
| hostname | osuosl1-amd64 or osuosl2-amd64 | the other one | |
| domainname | is not yet varied between rebuilds of Arch Linux. | ||
| env TZ | TZ="/usr/share/zoneinfo/Etc/GMT+12" | TZ="/usr/share/zoneinfo/Etc/GMT-14" | |
| env LANG | LANG="en_US.UTF-8" | LANG="et_EE.UTF-8" | |
| env LC_ALL | LANG="en_US.UTF-8" | LC_ALL="et_EE.UTF-8" | |
| the build path | is not yet varied between rebuilds of Arch Linux | ||
| env PATH | is set to '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' because that's what makechrootpkg is using | ||
| env USER | jenkins | build 2 | |
| user/uid | jenkins/103 | build2/1235 | |
| group/gid | jenkins/105 | build2/1235 | |
| kernel version | Linux 6.9.7+bpo-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.9.7-1~bpo12+1 (2024-07-03) x86_64 | is currently not varied between rebuilds of Arch Linux. | |
| umask | 0022 | 0002 | |
| CPU type | AMD Opteron 62xx class CPU | same for both builds | |
| /bin/sh | /bin/dash | /bin/bash | |
| year, month, date | osuosl1-amd64: today (2024-08-06) or osuosl2-amd64: 398 days in the future (2025-09-08) | the other one | |
| hour, minute | hour and minute will probably vary between two builds... | the future system actually runs 398 days, 6 hours and 23 minutes ahead... | |
| Filesystem | tmpfs | same for both builds (currently, this could be varied using disorderfs) | |
| everything else... | is likely the same. There will be more variations in the wild. | ||