<Hagfish>reproducible installer images is a fantastic goal, it's great to hear that's being worked on <Hagfish>i hope that the OS images used by the official debian buildds (and the reproducibility-checking jenkins instances) can one day have their reproducibility confirmed <pabs3>Debian buildds don't use images though, just installs with debootstrap <pabs3>I guess similar for the jenkins instances <vagrantc>at some point we might have switched the reproducible builds infrastructure over to mmdebstrap, which can in some circumstances produce bit-for-bit identical tarballs <pabs3>(related to the second link; unfortunately it seems like Debian will stop having official live images at all soon, unless someone wants to do the work to fix them) <bauen1>Hagfish: pabs3: i'm talking about the ISO produced by debian-cd, there's a few small issues (gzip embedding names/timestamps, random serial number in mkfs.fat) and a few timestamps included, but some tools e.g. the debian-installer package don't use it (or don't use all of it) <pabs3>those fixes sound like they would get accepted <pabs3>I'm curious about the serial number, is that a similar to a UUID or? is deriving it from the SOURCE_DATE_EPOCH the way to go? <bauen1>pabs3: see man mkfs.fat => --invariant <bauen1>pabs3: well, i'm using simple-cdd as a wrapper around debian-cd, so i'm not 100% sure which of the issues i'm seeing are triggered because of that \o/ <pabs3>ah. hmm, the creation time doesn't have an option to set it *pabs3 wonders which timestamp gets fed to SDE <bauen1>pabs3: and then i still had to insert a few "clamp_mtimes" calls inside the wrapper of simple-cdd ; because some isolinux files get a new timestamp that is not based on SOURCE_DATE_EPOCH ; but i'm not sure where that is comming from <bauen1>i'll make a MR with my changes and see where that goes <bauen1>but that's only the easiest problems to fix, there will still be modified timestamps in the final image, just no more modified files ***roptat is now known as Guest2835