Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In a comment on the question Does Ubuntu deliberately contaminate its binaries to help NSA?, Jorge Castro notes that debian is thinking about working with reproducible builds. They state

Why do we want reproducible builds?

  1. Independent verifications that a binary matches what the source intended to produce.
  2. Help Multi-Arch: same packages co-installation (as they need every matching file to be byte identical).
  3. Be able to generate debug symbols for packages which do not have a “debug package”.
  • Is there any indication that Ubuntu plans on implementing reproducible builds as well?
share|improve this question
up vote 6 down vote accepted

(This is a copy of my answer on ubuntu-devel.)

With very few exceptions, nearly all of Debian's work on this will just be going into the packages that form part of the package build toolchain, and as such Ubuntu will inherit it over the natural course of merging and syncing packages from Debian. The possible exceptions are things like the proposed libfaketime etc. preloads that we might insert into builds; I'd certainly be keen to keep up to date with things Debian does in this area, not just to protect against intrusion but also because there are immediate practical benefits to doing so (safer multiarch handling).

I'm not aware that this has been specifically discussed within Canonical, mostly because most of the relevant people are pretty heads-down working on the Ubuntu Touch product at the moment; but I also think there's work to be done in Debian first before we pick anything up.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.