Notices by Vagrant Cascadian (vagrantc@floss.social)

Just in case you were wondering how the USA #ElectoralCollege works #TheyMightBeGiants have answers:

https://tmbw.net/wiki/Who_Are_The_Electors%3F

@zacchiro @osuosl

It was great to see a couple talks at #FOSSY24 the past couple days about OSUOSL!

#OSUOSL have been hosting machines for #ReproducibleBuilds for many years!

I have personally performed thousands of manual builds debugging reproducibility issues using their machines!

And thousands of automated package (re)builds per day, across several different software distributions:

https://salsa.debian.org/qa/jenkins.debian.net/-/blob/d34fd5c049d628e03611c39f8dfad4eb3adca9e7/README.infrastructure#L41

Huge thanks to the people keeping all this great infrastructure running!

I gave a talk at Open Source Firmware Conference this year, Reproducible Builds All The Way Down:

https://www.osfc.io/2023/talks/reproducible-builds-all-the-way-down/

Slides available:

https://salsa.debian.org/reproducible-builds/reproducible-presentations/-/tree/master/2023-10-11-Reproducible-Builds-All-The-Way-Down

It was well received, highlighting many historic #ReproducibleBuilds issues in firmware projects that I maintain in #Debian and touching on the hows and whys of Reproducible Builds.

Open Source Firmware can be a great example of 100% reproducibility, with a narrow scope of code, and is often a key part in early system boot!

@janneke @amszmidt @ekaitz_zarraga @loke

How do you verify that software is free software?

Incomplete source code that compiles and runs, but behaves differently in subtle ways depending on any number of non-deterministic factors... how does someone verify that? Or complete source code with compomised toolchain?

The promises of Free Software are a little empty if you cannot verify the results.

Weather it should be part of a Free Software definition, I don't know... that gets complicated!

@janneke @amszmidt @ekaitz_zarraga @loke

I am not sure I want to:

Run a program if it is not going to do what I tell it to...

Study something that will behave differently than the source code, effectively gaslighting me...

Share copies with subtly compromised behaviors and agendas...

Or share modified versions if they also have compomised behaviors...

Reproducible Builds and Bootstrappable Builds make it possible to verify that Free Software freedoms can be meaningfully exercised.

@janneke @amszmidt @ekaitz_zarraga @loke

The crux of my talk was that Reproducible Builds, Bootstrappable builds and Free Software may each be independently useful, but much stronger if you have all of them.

Reproducible Builds demonstrates a strong connection between the source code and the binaries to be run, modified or shared.

Bootstrappable Builds strengthens confidence in the toolchain.

Free Software makes it possible to verify the other two by independent third parties.

@dexter

And I forgot to mention that with some refactoring, there is work to get that 357 byte "binary" down to something more like 256 bytes or so...

With a few small bumps, managed to get the #Librem5 booting into a #Mobian installer, and installed with an encrypted rootfs!

So far, only have #Dino configured, but that is enough for this to be a hugely useful communications device, especially with #JMPchat to connect up to telephony networks!

Love the kill switches for cellular modem, wifi/bluetooth and camera/mic!

This is my first #Debian #Trixie based computer, as there may be issues with the now-stable #Bookworm on this hardware.

I will be presenting about #ReproducibleBuilds at #FOSSY this year:

Breaking the Chains of Trusting Trust: Reproducible Builds and More!

https://2023.fossy.us/schedule/presentation/118/

Pretty excited, and a lot of interesting developments in recent years!

@reproducible_builds

#SupplyChain #BootstrappableBuilds

@reproducible_builds

Going to try to fix some long neglected #reproducible patches in #Debian

Thursday, 16:00UTC ... hope to make it a recurring habit!

https://lists.reproducible-builds.org/pipermail/rb-general/2022-September/002689.html