Fedora change aims for 99% package reproducibility

Re:Fedora change aims for 99% package reproducibility by 0zymandiass on Friday April 11, 2025 @12:23PM (#43655585)

If you'd bothered to read:

```This definition excludes signatures and some metadata and focuses solely on the payload of packaged files in a given RPM:

    A build is reproducible if given the same source code, build environment and build instructions, and metadata from the build artifacts, any party can recreate copies of the artifacts that are identical except for the signatures and parts of metadata.```

[ Parent | on HN ]

Re:Fedora change aims for 99% package reproducibility by patrakov on Friday April 11, 2025 @10:24PM (#43660750)

The same LWN article says:

> The contents, however, should still be "bit-by-bit" identical, even though that phrase does not turn up in Fedora's definition.

So, according to the literal interpretation of the article, signatures inside the payload (e.g., files that are signed using an ephemeral key during the build, NOT the overall RPM signature) are still a self-contradictory area and IMHO constitute a possibly-valid reason for not reaching 100% payload reproducibility.

[ Parent | on HN ]