rebuilderd 0.9.0: reproducible builds verification system used by Arch Linux

• git2-rs

  8 1,597 8.0 Rust

  libgit2 bindings for Rust

  

Yes! We have multiple rust projects in Arch Linux that we've successfully rebuilt, for example rebuilderd or rustc/cargo itself. We occasionally run into projects that aren't reproducible, this is usually due to issues in build.rs. One of the issues I fixed is this one: https://github.com/rust-lang/git2-rs/pull/619

• rebuilderd

  6 343 5.3 Rust

  Independent verification of binary packages - reproducible builds

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• ismyarchverifiedyet

  3 13 4.5 Python

  :construction: Experimental script to query rebuilderd for results :construction:

We're still focusing on getting the rebuilding more mature (and make sure we're correctly covering all debian quirks) so we don't generate cryptographic attestations yet. A client is supposed to fetch reports from multiple independent rebuilders over https and define a threshold of how many have to approve a package for it to be considered trusted, a basic example for this looks like this: https://github.com/kpcyrd/ismyarchverifiedyet

Suggest a related project