(V) (°,,,°) (V)
Same as last year , this is a summary of what I’ve been up to throughout the year. See also the recap/retrospection published by my friends ( antiz , jvoisin , orhun ). Uploaded 467 packages to Arch Linux Most of them being reproducible , meaning I provably didn’t abuse my position of compiling the binaries 35 of them are signal-desktop 29 of them are metasploit Made 53 uploads to Debian All of…
rebuilderd v0.25.0 was recently released, this version has improved in-toto support for cryptographic attestations that this blog post briefly outlines. 😺 As a quick recap, rebuilderd is an automatic build scheduler that emerged in 2019/2020 from the Reproducible Builds project doing the following: Track binary packages available in a Linux distribution Attempt to compile the official binary…
Dear blog. This post is inspired by an old friend of mine who has been writing these for the past few years. I meant to do this for a while now, but ended up not preparing anything, so this post is me writing it from memory. There’s likely stuff I forgot, me being gentle with myself I’ll probably just permit myself to complete this list the next couple of days. I hate bragging, I try to not depend…
I recently mentioned on the internet I did work in this direction and a friend of mine asked me to write a blogpost on this. I didn’t blog for a long time (keeping all the goodness for myself hehe), so here we go. 🦝 To set the scene, let’s assume we want to make an exectuable binary for x86_64 Linux that’s supposed to be extremely portable. It should work on both Debian and Arch Linux. It should…
I’ve released a new tool to manage dependency lockfiles for Arch Linux packages that can’t use a lockfile from the official upstream release. It integrates closely with other Arch Linux tooling like updpkgsums that’s already used to pin the content of build inputs in PKGBUILD . To use this, the downstream lockfile becomes an additional source input in the source= array of our PKGBUILD (this is…
I noticed there’s a common anti-pattern in some PKGBUILDs, the short scripts that are used to build Arch Linux packages. Specifically we’re looking at the part that references the source code used when building a package: source =( "git+https://github.com/alacritty/alacritty.git#tag=v ${ pkgver } ?signed" ) validpgpkeys =( '4DAA67A9EA8B91FCC15B699C85CDAE3C164BA7B4'…
If you’ve been following my twitter recently you probably noticed there’s now a rebuilderd based Debian rebuilder run by the Purdue Trustworthy Software Ecosystems Lab . The rebuilder backend - the code that’s actually re-creating the build environment and running the build - is debrebuild.py , written by Frédéric Pierret from the QubesOS project. The setup as a whole automatically monitors…
rebuilderd 0.15.0 very recently released, this is a short intro into what it is, how it works and how to build our own integrations! rebuilderd monitors an index of artifacts and parses it into a datastructure that looks like this. In the most basic case, based on the distro field it’s going to pick the right build script and attempt to generate an artifact identical to the file linked to in url .…
This is the monthly report of what I’ve been up to in September 2021. 🙌 Reproducible Builds There have been 3 releases of rebuilderd this month, 0.14.0 , and two minor bugfix releases, 0.14.1 and 0.14.2 . The 0.14.0 release introduced experimental support to rebuild Tails images in #66 . Tails is a portable operating system that’s known for it’s strong focus on privacy and security, and commonly…
This is the monthly report of what I’ve been up to in August 2021. 🙌 Reproducible Builds There are many different reasons to be interested in Reproducible Builds. When I originally got involved in the project I wasn’t a maintainer in any Linux distribution yet, instead I was wondering if there’s a way to distribute pre-compiled artifacts as an independent open source dev without carrying all the…