Re: Compromising Debian Repositories

[Timo Juhani Lindfors <timo.lindfors@iki.fi>]

adrelanos <adrelanos@riseup.net> writes:
> Some Debian maintainers are working on deterministic builds, although
> they call it reproducible builds, that's great! Link:
> https://wiki.debian.org/ReproducibleBuilds

Terminology is hard :) As mentioned in the bof we can make sure that the
build is deterministic or we can record sources of randomness
(gettimeofday calls etc.) and then replay then in subsequent
builds. Would that still qualify as deterministic for you? See the
references I added for deterministic virtual machines, their fight
agaist the rdtsc instruction is exactly the same that we have with
gettimeofday :)