Re:Running an independent Arch Linux rebuilder
by tomjakubowski on Tuesday April 21, 2020 @06:47PM
(#22940139)
This is a question of the artifacts distributed as part of Arch Linux, the tar.xz packages. The idea is to be able to reproducibly build a package from source (where "source", yes, may include binary assets and blobs), and check that the copy you built matches what Arch distributes, byte for byte. This way, you know the packager hasn't introduced unexpected changes.
Since end users build AUR packages themselves, there is nothing distributed, and nothing to verify.
Since end users build AUR packages themselves, there is nothing distributed, and nothing to verify.