Fedora 41 Approved To Make Package Builds More Reproducible
Fedora 41 has been eyeing more reproducible package builds thanks to a Rust program. The Rust-based "add-determinism" would be part of the post-build cleanup process for RPM package builds to address common causes of build irreproducibility. This change is capable of making most Fedora RPM package builds reproducible in the name of security and auditability. As explained in that change proposal:
"add-determinism is a Rust program which, as its name suggests, adds determinism to files that are given as input by attempting to standardize metadata contained in binary or source files to ensure consistency and clamping to $SOURCE_DATE_EPOCH in all instances. add-determinism is the "Fedora version" of strip-nondeterminism from the Debian project. Since strip-nondeterminism is written in perl, it is undesirable for use in Fedora, as we don't want to pull perl in the buildroot for every package.
It's worth noting that this Change does not intend to impose any specific reproducibility requirements on Fedora packages. Once this Change is implemented and we have been through a mass rebuild and can verify that the common causes of irreproducibility have indeed been removed, we can consider further steps. But that will be at least one release later.
This change does add a small amount of time to the processing of RPMs at the end of a build. Accordingly, packages containing large quantities or sizes of files be slower, but this effect is not expected to be noticeable. add-determinism takes steps to ensure it does not interfere with other buildroot post processors like mangle-shebangs, python-hardlink, python-bytecompile. It defaults to not doing any modifications in case it doesn't understand the input file or there are any other problems."
All FESCo members are on-board with the proposal and it's now been approved for the Fedora 41 release this autumn.
The add-determinism program for those interested can be found on GitHub.
14 Comments
