Hello publicity team,I had a short discussion on #debian-publicity, and will now move to the mailing list, to have this discussed a-synchronously (as I'm not always online on OFTC).
I've sent the following to the reproducible-builds mailing list: https://lists.reproducible-builds.org/pipermail/rb-general/2025-March/003675.html after which Holger Levsen suggested that a wider broadcast would be better :-)
Joost van Baal proposed the following text for the 'tweet'/'toot':"since the recent bookworm 12.10 point release, the bookworm live images are now fully reproducible"
Should the persons mentioned in the 'thank-you' be informed before the announcement is made?
Timing: IMHO there is no immediate hurry to rush this announcement on short notice, so the draft can be polished in a few iterations.
With kind regards, Roland Clobus Proposal for a longer text: --- start of the working draft ---For a while it has been possible to have a reproducible build [1] of the unofficial live images for Debian [2]. With the point release of bookworm 12.10, the official live images [3] are reproducible as well.
This provides certainty that the live images are genuine and have not been tampered with.
Technical instructions about how to verify the images yourself are in the Debian Wiki [4].
Not only are the live images generated reproducibly, but their functionality is also tested regularly. Automated tests for sid [5], trixie [6] and bookworm [7] verify that the software inside the images is working as intended, and that the installers (plural!) result in a bootable system.
This work has been made possible by @@@(I hope I'm not forgetting someone)@@@:
* Roland Clobus (further development of live-build) * Luca Boccassi (reviewing and merging all the changes on Salsa) * Holger Levsen (support for reproducible builds and jenkins.d.n)* Steve McIntyre (support for setting up automated builds of the official images)
* Philip Hands (support to automated functionality tests on openqa.d.n)* Many Debian Developers/Maintainers/Contributors for applying patches to make the installed version of their package reproducible
[1] https://reproducible-builds.org/ [2] https://jenkins.debian.net/view/live/[3] https://cdimage.debian.org/cdimage/release/current-live/amd64/iso-hybrid/
[4] https://wiki.debian.org/ReproducibleInstalls/LiveImages [5] https://openqa.debian.net/group_overview/17 [6] https://openqa.debian.net/group_overview/18 [7] https://openqa.debian.net/group_overview/19 --- end of the draft ---
Attachment:
OpenPGP_signature.asc
Description: OpenPGP digital signature