Introduction
This page tracks the progress of FSDG distributions with regard to reproducible builds, bootstrapable builds and other similar security features.
Releases and signatures
| Distribution
|
Signed installers
|
| Dragora 3.0-beta1
|
Checksums only[1]
|
| Dynebolic 3.0-beta
|
Broken: signed broken checksums (md5)[2]
|
| Guix 1.4.0
|
Yes, signed images[3]
|
| Guix "latest"
|
No[4]
|
| Hyperbola v0.4.2
|
Yes, signed images[5]
|
| LibreCMC
|
Yes, signed checksums[6]
|
| Parabola
|
Yes[7]
|
| ProteanOS
|
Yes: signed ProteanOS Development Kit commits[8]
|
| PureOS 10 (byzantium)
|
Checksums only.[9]
|
| Replicant 6.0 0004
|
Yes, signed images[10]
|
| Trisquel 10.0.1
|
Yes, signed images[11]
|
| Ututo S
|
No: broken checksums (md5) only[12]
|
Development source code and signatures
| Distribution
|
Signed development source code
|
| Dragora
|
?
|
| Dynebolic
|
?
|
| Guix
|
Yes, signed commits, authentication tool and instructions[13]
|
| Hyperbola
|
?
|
| LibreCMC
|
?
|
| Parabola
|
No policies requiring to sign commits
|
| ProteanOS
|
Yes: signed commit and verification instructions.[14]
|
| PureOS
|
?
|
| Replicant
|
No policies requiring to sign commits
|
| Trisquel
|
?
|
| Ututo S
|
?
|
Repdoducible builds and bootstrapable builds
Self hosted distributions
| Distribution
|
Reproducible builds officially supported[15]
|
Comments
|
| Dragora
|
?
|
- Not mentioned in the list of project supporting reproducible builds[16].
|
| Dynebolic
|
?
|
- Not mentioned in the list of project supporting reproducible builds[16].
|
| Guix
|
Yes
|
- Encourage any users to use the Guix challenge command to check the reproducibility of builds, and builds are supposed to be reproducible for all users (independently of the specific CPU, username, etc)
- Goes beyond reproducible builds and has efforts to make Guix bootstrapable
- Mentioned in the list of project supporting reproducible builds[16].
|
| Hyperbola
|
?
|
- Not mentioned in the list of project supporting reproducible builds[16] but Arch Linux is mentioned there so maybe it's easier to add reproducible builds to Hyperbola.
|
| Parabola
|
?
|
- Not mentioned in the list of project supporting reproducible builds[16] but Arch Linux is mentioned there, and for x86_64 some of the stock Arch Linux are reused. So at least part of Parabola is reproducible.
- It has a wiki page that has a plan to add reproducible builds[17] but it needs people to work on actually doing some research on how to add reproducible builds and to implement it.
- Arch Linux status: https://tests.reproducible-builds.org/archlinux/archlinux.html
|
| PureOS
|
?
|
- Not mentioned in the list of project supporting reproducible builds[16] but Debian is mentioned there so maybe it's easier to add reproducible builds to Hyperbola.
|
| Trisquel
|
?
|
- Not mentioned in the list of project supporting reproducible builds[16] but Debian is mentioned there so maybe it's easier to add reproducible builds to Hyperbola.
|
| Ututo S
|
?
|
- Not mentioned in the list of project supporting reproducible builds[16].
|
Small distributions
| Distribution
|
Reproducible builds officially supported[15]
|
Comments
|
| LibreCMC
|
?
|
- Not mentioned in the list of project supporting reproducible builds[16] but OpenWRT is mentioned, so it might be easier to add reproducible builds to LibreCMC.
|
| ProteanOS
|
?
|
- Not mentioned in the list of project supporting reproducible builds[16].
|
| Replicant
|
not yet
|
- Not using the Android prebuilt toolchain is the first priority, then we probably need to find how to activate reproducible builds when building releases.
- Not mentioned in the list of project supporting reproducible builds[16].
|
