Fedora 41 Approved To Make Package Builds More Reproducible

[ssokolow]

OK.
So are builds creating randomly different binaries or not?

They're creating randomly different binaries in the same sense that a PRNG produces random numbers.

[mSparks]

They're creating randomly different binaries in the same sense that a PRNG produces random numbers.

PRNG is deterministic, so the basic confusion is just these guys dont know what non deterministic means?

[ssokolow]

PRNG is deterministic, so the basic confusion is just these guys dont know what non deterministic means?

No. It's sort of the difference between de facto and de jure. The builds are de facto non-deterministic because it's not practical for the average user who wants to reproduce things to figure out what all the inputs they need to pin down are, and those inputs tend to come from souces that "may as well be random" for how little such users are able to identify what is varying and why.

(i.e. As far as users who want to reproduce builds without being domain experts are concerned, a build hash that takes a timestamp as input for some reason is indistinguishable from a true random number being embedded in the code.)

In essence, they're calling it non-determinism because, in this context, it's most useful to apply "guilty until proven innocent" rules and say that behaviour is non-deterministic until it can "cite its sources". (Basically, similar to how we apply sandboxing to applications because, in the world of security, it makes sense to assume that something is insecure until proven otherwise.)

TL;DR: They know what non-determinism is. They're using it in a Clarke's Third Law-esque "sufficiently obscured side-channel inputs are indistinguishable from random inputs as far as the relevant demographics are concerned" sense.

[mSparks]

a build hash that takes a timestamp as input for some reason is indistinguishable from a true random number being embedded in the code.

Agreed.
How was this ever a thing?

[ssokolow]

Agreed.
How was this ever a thing?

I mainly saw it as a low-effort reaction to Git not replicating CVS and Subversion's support for substituting keywords like $Revision$ in specially marked source files on checkout. (i.e. It began as incorporating the revision rather than the build timestamp and they were too lazy to wrap the Git porcelain in their build automation to re-implement it.)