Good thing. NetBSD has fully reproductible build since 2017. https://blog.netbsd.org/tnf/entry/netbsd_fully_reproducible_...

As pointed in your link, NetBSD achieved this with some help from Debian. If I understand correctly, it's not that NetBSD tried harder, it's that their problem was easier: fewer packages which change less (they still use CVS, "stability" is an understatement!).

BTW, most Debian packages have reproducible builds. Those which have not (I'd say 5%) are shown in orange in the graph there: https://wiki.debian.org/ReproducibleBuilds

Also, the *BSD are structured somewhat differently to a Linux distro.

It's not like the Linux world where you have distinct projects like the Kernel, GNU, OpenSSL, and then it's the distributions job to assemble everything.

In the BSD projects, the scope is developing and distributing an entire base system, i.e., the kernel but also the libc, the shell/all posix utilities, and a few third parties like OpenSSH (which are usually "softforked").

It's quite visible in the sources, it's a lot more than just a kernel: https://github.com/NetBSD/src

Additional packages you could get from pkg_in/pkgsrc (NetBSD), pkg-ng/ports (FreeBSD) or pkg_add (OpenBSD) are clearly distinct from the base system, installed in a dedicated subtree (/usr/src in NetBSD, /usr/local/ OpenBSD/FreeBSD), and provided in a best effort manner.

The reproducible build target was almost certainly only for the base system, which is a few percent of what Debian tries to achieve, and on which NetBSD has a tighter control over (developer + distributor instead of downstream assembler+distributor).

A reproducible base system is useful, but given how quickly you typically need to install packages from pkgsrc, it's not quite enough.

> it's not that NetBSD tried harder, it's that their problem was easier: fewer packages which change less

Maybe that's trying harder on design rather than trying to remedy the consequences later.

While we are bragging, stagex was the first to hit 100% full source bootstrapped deterministic and hermetic builds last year and the first to make multiple signed reproductions by different maintainers on their own hardware mandatory for every release.

Debian has come along way, but when Debian says reproducible they mean they grab third party binaries to build theirs. When we say reproducible we mean 100% bootstrapped from source code all the way through the entire software supply chain.

We think that distinction matters.

https://stagex.tools

Stage -1: `hexdump`, `xxd`, or whatever you use to write files to your filesystem.

newcomers will always have it much easier. also guix i think also reached this.

also, stagex and others probably profited QUITE A LOT from the debian efforts, because they started to go upstream and talking to developers..

just arch linux profited from debian maintainers a decade before that an debian people asking upstream to improve...

This!

Unfortunately, the term “reproducible” can be interpreted in many ways because there is no strict and complete definition. People and projects bend it to their liking.

Your approach is correct.

https://www.bootstrappable.org/

That distro has smaller codebase than Debian Installer.

You might like https://smolbsd.org/

Well yes, I do like that:), but I don't see the connection to this thread?

Yesterday was NetBSD's 33rd Birthday. Nice time to share it :)

That’s an awful lot of birthdays for something Netcraft confirmed dead 20 years ago …

US should rather sanction Pakistan than getting IMF loan to it.

And what will Pakistan do with such an IMF loan? The Generals would siphon off most of it to buy their palatial Dubai houses and London condos. Until Pakistan cleans up its act, giving it more loans it throwing good money after bad.

> The Generals would siphon off most of it to buy their palatial Dubai houses and London condos.

Next door to other world leaders doing the same? Is that truly our motivation for not transferring the money? Some generals might illicitly buy houses?

> Until Pakistan cleans up its act

I'm sure "The Generals" are going to help there.

> giving it more loans it throwing good money after bad.

Abandoning them entirely as hostages is not acceptable.

I had sort of hoped our Democracy would afford for a more effective approach. If you find those generals so onerous why don't you go fly over there and assassinate them?

The parent comment is suggesting sanctioning them, not giving them IMF loans.

It took me 5 rereads before I properly read "should" instead of "would", which totally flips the implication!

How would sanctions help?

If you block loans they will try and act on trading with other countries which will be more helpful overall than just throwing money at the problem

And that prevents hospitals from reusing needles, how?

This is good. Also CERN should be back using NetBSD for research purposes.

I prefer syncting

Hmm.. asistant i can't escape this screen what is it?

A.i: this is vi text editor.

Human: exit from it and open word processor.

A.i: rm -rf /

Human: good job exiting. Now where's my word processor? ....

Hello? Where's my word processor? Brint it on screen.

Can you hear me ?

How about create a company/corporation and hold all sources under it. So directors of that company can change to later versions

I hoped they would have gone with HMD or BlackBerry.

Why? Multiple times in the last 8 or so years I've considered both Nokia (HMD) and Motorola. Looking at reviews and specs I decided every time in favor of Motorola, despite liking the design of Nokia's more, and didn't regret it.

I was secretly hoping Framework would have produced a phone that would collaborate with GrapheneOS. I know it is a stretch, but one can dream.

I wish Framework would release one of its regular laptops, beefy battery and all, except it runs Android (on an ARM processor of course).

I mean, they already have RISC-V.

https://frame.work/se/en/products/deep-computing-risc-v-main...

But seeing posts like this also helps one wonder we might need AI more than we think https://www.reddit.com/r/Indian_flex/s/JMqcavbxqu