Re: Is Debian Live System Reproducible?

["Thomas Schmitt" <scdbackup@gmx.net>]

Hi,

Andres Pavez wrote:
> Is Debian Live System reproducible?

I can only speak for the last step of ISO production by xorriso.
It is reproducible if you force the "now" timestamps like the modification
date to the same value as with the original ISO.
This can be achieved by the environment variable SOURCE_DATE_EPOCH as defined
by reproducible-builds.org. See also ENVIRONMENT at the end of man 1 xorriso.

The chances are best if this variable was already set when the original
ISO was produced.
If you have no such original SOURCE_DATE_EPOCH value, you may deduce it
from the timestamp as issued by
  xorriso -indev debian-live-8.4.0-i386-standard.iso -pvd_info 2>/dev/null \
  | grep Creation
E.g.
  Creation Time: 2016040221250200
means: year 2016, month 04, day 02, 21:25:02, 0 hundredth seconds.
You'd need to convert this to a time(2) seconds number.


The more general problem will be to get the same file attributes on all
participating input files. You might have a chance by not copying the files
out of the ISO but by using the mounted ISO as source of input files.

(In general this strive for reproducibility makes sense only if you
 want to test that locally modified production steps do not influence the
 result. In all other cases i can imagine, simply use cp to clone the ISO.)


Have a nice day :)

Thomas