Holger Levsen

In this talk Holger Levsen will give an update on Reproducible Builds of Debian and beyond. He’ll briefly sum up the status in Bullseye, then present development goals and choices for Bookworm, what’s planned, being built and wished for! Bookworm will be the fourth Debian release since work on Reproducible Builds of Debian has really started: we started with the beginning of the Stretch cycle, then continued with Buster and Bullseye, and this year we're working on making Bookworm more reproducible, while already knowing we won't be done once Bookworm will be released. In this talk Holger will explain what exactly has been improved, where we are, why we still are not “there” yet (nor in 12 months) and what our immediate plans are. So come and see this talk!

The Debian developers-reference handbook, or src:developers-reference or https://www.debian.org/doc/manuals/developers-reference/ will turn 25 years in 2022 and while it has seen quite some modernisation over the years, there are still many areas of Debian where the reference has become somewhat outdated... Holger will present a tiny bit of history of this important package, quickly present the modern parts (git, markdown, part of the Debian group on salsa) and the current translation workflow (which needs an overhaul...) and then finish the talk with a simple summary of all open wishlist bugs, which are mostly about pieces of documenation which needs to be written. If you are looking for ways to improve Debian by writing and improving documentation and or translating it, this talk is for you!

In this talk Holger Levsen will give an update on Reproducible Builds of Debian. He'll briefly sum up the status in Buster, then present developsments in and for Bullseye and give an outlook on Bookworm, what's planned, being built and wished for! Bullseye will be the third Debian release since work on Reproducible Builds of Debian has really started: we started with the beginning of the Stretch cycle, then continued for Buster and we are still not done with our work on Bullseye, though hopefully at the time of the talk we will be. And then of course we will continue for Bookworm and beyond! The last paragraph might leave you wondering, what exactly has changed, where we are, why we still are not "there" yet and what our immediate plans are. So come and see this talk!

The goal of this talk is to give a an update on the state of Reproducible Builds for the upcoming Debian "bullseye" release, focussing on the promise of enabling anyone to independently verifying that binaries distributed on ftp.debian.org were made using the sources. It’s been 7 years since Reproducible Builds were first introduced to the Debian community at large at DebConf13 in Vaumarcus and much progress has been achieved since, yet without some dedicated actions from several teams in Debian it will very hard to verify those binaries we actually distribute. So the idea is to present the curent status of the project together with a hopefully complete list of bugs preventing the above promise from being reality and sparking some work together to fix at least some of the bugs during DebConf 20 online. Slides: https://reproducible-builds.org/_lfs/presentations/2020-08-27-Reproducing-bullseye-in-practice/

On July 18th Stretch LTS starts, offering two more years of security support to the Debian Stretch release. Stretch LTS will be the fourth iteration of LTS, following Squeeze LTS which started in 2014, Wheezy LTS in 2016, and Jessie LTS in 2018. The LTS team would like to gather together to discuss the work they’ve done so far and the work that needs to be done for the upcoming years, areas that could be improved upon, and potentially discussing the feedback that we've got from the LTS survey!

Other people: Utkarsh Gupta

Started in late 2014, [Debian LTS](https://wiki.debian.org/LTS/ "Debian LTS") exists and has provided additional security support for the Squeeze, Wheezy and Jessie releases. LTS support for Stretch is also planned. In this BoF we want to briefly explain how LTS is done, how you can support it, either finanically or by volunteer work and provide a venue for discussions how to improve it. The targetted audience for this talk is everyone, user, contributor, sysadmin, sponsor, you. Though of course due to the subjects being discussed this will be a quite technical discussion.

Other people: Hugo Lefeuvre Chris Lamb Markus Koschany

Get-together to discuss if, how, when and where to possibly have a MiniDebconf 2020 in Germany.

Other people: Tobias Frost Michael Banck Lee Garrett

The goal of this talk is to give the whole Debian community an update on the state of Reproducible Builds in Debian and in the whole free software world as well as to explain what we are aiming for the bullseye release. It’s been 6 years since Reproducible Builds were first introduced to the Debian community at large at DebConf13 in Vaumarcus and much progress has been achieved since, yet the buster release has not really achieved reproducible builds. In this talk we will explain the current status, explain what's missing and hopefully present workable ideas how to improve things for bullseye.

Other people: Chris Lamb Vagrant Cascadian

Since more than ten years I have been maintaining (what has become) piuparts.debian.org mostly by myself, with some notable help by DSA hosting stuff and Andreas Beckmann providing patches and filing (lots of very valuable RC) bugs. There also have been many people who have submitted bugs and patches, for which I'm very thankful too. But, the everyday maintenance of the piuparts.debian.org service is on my shoulders, I'm deploying changes and I'm deciding what code to merge and deploy. This works nicely but has become boring and tedious too. Recently I have asked for i386 piuparts-slaves to be provided by DSA. DSA replied (on irc, there's no reply on https://rt.debian.org/Ticket/Display.html?id=6787 ) that they would prefer if those systems were not maintained by DSA but by the piuparts.d.o maintainers which is largely/only me. (And don't get me wrong, I ♥ DSA, this is just an example where I feel I cannot commit to do more permanent maintenance work on p.d.o...) I'd like piuparts.d.o to be extended to other architectures and whatnot, also to use piuparts for release.d.o even more, but, I also like this to be long term sustainable. This is like my 3rd or 4th attempt to improve this situation, I'm curious for the DebConf19 edittion ;) Disclaimer for readers in the future: of course this talk description is exaggerated, born out exhaustion and frustration. It's is a lame attempt to get more people involved. A non-lame attempt would focus more on the fun sides and the joys of being (partly) responsible that Debian lives up to the high quality standards it's known for. Hopefully $you will be proposing this talk for DebConf20 or 21! It's a bit more work than such a lame attempt but it's totally worth it! Carry the piuparts torch into the next decade!

The goal of this talk is to give the whole Debian community an update on the state of Reproducible Builds in Debian and in the whole free software world. It's been 5 years since Reproducible Builds were first introduced to the Debian community at large at DebConf13 in Vaumarcus and much progress has been achieved since. In this talk we will present some milestones we have reached since then, show where our current blockers are and give an outlook on what we consider still achievable until the Buster freeze. While it is true that we have been quite succesful in promoting Reproducible Builds, both the concept as well as actual patches in a great number of projects, too many people are misled by our "93% of Debian packages are reproducible (in theory)" statistics and other things. So, to sum up, Buster is not frozen yet and so we are still working on making Buster as reproducible in practice as possible. And we want to go even further in future! To achieve this we want and need to take all of Debian with us on this journey.

Other people: Chris Lamb

Whilst anyone can inspect the source code of free software for malicious flaws, software in Debian is distributed pre-compiled to end users. The motivation behind the Reproducible Builds effort is to permit verification that no flaws have been introduced — either maliciously or accidentally — during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised. This talk will explain the current status of the Debian Reproducible Builds project, what has changed in the last year, how this is relevant to you as a maintainer, and how this is relevant for the complete free software eco system and, finally, how you can contribute.

Other people: Chris Lamb

Currently piuparts.debian.org only tests Debian amd64. In this BoF we want to discuss how to scale this to multiple architectures and possible how to rewrite the web UI so that it scales with both more architectures as well as with 10 times more suites than it was written for. Basically if you are interested to help by writing a nice(!) webapp, you should attend this BoF. Or to put it differently: if you want to help Debian, but don't know how, this could be your opportunity to contribute to a rather central QA tool in Debian! Scaling piuparts to support multiple architectures could be done using two ways: the dumb and the smart way, where the latter uses a bit less hardware ressources but will require a bit of python coding. Join if you want to help here. (Also, we could start with the dumb way and later switch to the smart way…)

For more than two decades I've been using Debian as my primary and only OS on my primary computer (and almost all others computers I've been touching), and in February 2017 I finally made the switch and installed Qubes OS, which currently is based on Fedora 23 (while 26 is their latest release). That said, I'm still (mostly) running and developing Debian inside Qubes OS, as - very roughly said - Qubes OS is just another virtualisation layer between the CPU and the user. So in this talk I will explain in more detail what Qubes OS is, what advantages using Qubes OS brings, what downsides it has and how I made my transition to a more secure setup, and what challenges I faced. Of course I'll also explain why I went with using the Fedora based Qubes OS instead of porting it to Debian and what options there are for a future with a Debian based Qubes OS. https://qubes-os.org https://wiki.debian.org/Qubes https://wiki.debian.org/Qubes/Devel

jenkins.debian.org shall become what jenkins.debian.net is, except it should run (the service) on a DSA maintained system (some of the nodes doing the work might not be DSA maintained…) This workshop is about the transition from jenkins.d.n to jenkins.d._o_ and how we can make it happen and how we can make it good. It will also give an overview about the 1400 jobs running on jenknis.d.n and how to contribute new jobs or modify existing ones.

The presentation will describe how the Debian reproducible builds team made 85% of the Debian archive reproducible, what steps are left to reach 100% and what steps are needed beyond reproducible builds, so that every user can easily and meaningful benefit from them.

The presentation will be largely about the Debian work on the area, but it will also portray other projects work on reproducible builds, as our goal is to make reproducible builds the norm for free software: "It's not free software if it's not reproducible."

Reproducible builds enable everyone to verify that a given binary is made from the source it is claimed to be made from, by enabling anyone to create bit by bit identical binaries.

This talk will report on the state of reproducible builds in various distributions (Debian, Archlinux, coreboot, F-Droid, Fedora, FreeBSD, Guix, NetBSD, OpenWrt, SuSE, and Qubes OS - to name a few) and thus should be interesting and insightful for anyone working on any free software project.

Holger will explain how he started working on this in the Debian context and how his focus shifted slightly over the last 12 months. So he will start with explaining the status of Reproducible Debian, but this is quickly followed by an overview of common problems and solutions, followed by a quick explaination of the shared test infrastructure for reproducible tests of any project. You will learn how the community was broadened, what future plans we have to address what might be needed beyond being able to reproducible build something, so this becomes truly meaningful for users in practice.

So yes, it's a complex topic and a big task, but by now it seems we managed to get our messages accross pretty well, as for example nowadays some people already expect the immiment release of a reproducible binary distribution. Sadly it is not the only question whether this will happen in 2016 or 2017 even though it could happen, there is "just" is still a of work ahead almost everywhere, in those nitty gritty details.

With free software, anyone can inspect the source code for malicious flaws. But Debian provide binary packages to its users. The idea of “deterministic” or “reproducible” builds is to empower anyone to verify that no flaws have been introduced during the build process by reproducing byte-for-byte identical binary packages from a given source.

This talk will explain the current status of the Debian Reproducible Builds project, how this is relevant for the complete free software eco system and how you can contribute.

see https://wiki.debian.org/ReproducibleBuilds and https://reproducible.debian.net

Other people: Jérémy Bobbio (Lunar)