Why reproducible builds are important is explained at reproducible-builds.org:

Whilst anyone may inspect the source code of free and open source software for malicious flaws, most software is distributed pre-compiled with no method to confirm whether they correspond.

This incentivises attacks on developers who release software, not only via traditional exploitation, but also in the forms of political influence, blackmail or even threats of violence.

According to isdebianreproducibleyet.com Debian is currently only 94.7% reproducible.

Packages in buster/amd64 which failed to build reproducibly are listed here.

Is there a simple and fast way to list all unreproducible packaged installed on the system?

I'm thinking of something like debsecan | grep "remotely exploitable" for identifying installed packages with vulnerabilities or vrms for making sure no packages which aren't free, open source software are installed. Does such a tool or script exist?


It’s important to note that the results shown in the reproducible builds information only reflect the theoretical reproducibility in the current testing framework. They can’t necessarily be translated in statements on the reproducibility of the packages currently downloadable from the Debian repositories.

That said, the devscripts package includes a reproducible-check command whose aim is similar to what you’re looking for: it downloads the current results from the CI infrastructure, and compares that to the set of installed packages. However it is currently somewhat buggy, and the test results are only exported for Bullseye... Keep an eye on the upstream repository if you’re interested, the tool is being worked on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.