There was a bunch of activity around Reproducible Builds at #FOSDEM! A
On the main stage, core #ReproducibleBuilds dev Holger 'h01ger' Levsen presented "Titled Reproducible Builds: The First Ten Years" giving an overview: how it started with a small BoF at DebConf13 (and before), then grew from being a Debian effort to something many projects work on together, until in 2021 it was mentioned in an Executive Order of the President of the United States.
https://fosdem.org/2024/schedule/event/fosdem-2024-3353-reproducible-builds-the-first-ten-years/
@malte and @katexochen presented "Reproducible builds for confidential computing: Why remote attestation is worthless without it" in the Confidential Computing devroom, covering the status quo of how reference values are used in CC. Based on a minimal open source example, they explained how they build fully reproducible OS images with mkosi and #NixOS - all the way from source code in Git to the reference values for remote attestation.
"RISC-V Bootstrapping in Guix and Live-Bootstrap" was presented by @ekaitz_zarraga in the "Declarative and Minimalistic Computing" devroom, mentioning GNU Mes, TinyCC, GCC, live-bootstrap, GNU #Guix and other related projects.
The Nix and #NixOS devroom featured a lightning talk on "rix: an R package for reproducible dev environments with Nix" by @brodriguesco
Randrianaina proposes an approach for the automatic identification of configuration options causing non-reproducibility of builds. Applying it on three case studies, namely Toybox, Busybox, and Linux, they analyzed more than 2,000 configurations for each of them and finding direct, actionable information for improvement to the Linux community.
That was an interesting talk to systematically find kernel configuration options that led to non-deterministic results!
There was significant work, largely by @bwh to get #ReproducibleBuilds of the #Linux kernel packages in #Debian ... and other than documentation packages, it basically was ... but some things crept in along the way...
https://bugs.debian.org/1033663
https://salsa.debian.org/kernel-team/linux/-/merge_requests/741