no reproducible trisquel isos?

What is your question or comment @tonlee? Debian and Ubuntu also do not have reproducible builds - that is a very hard thing to accomplish. I think I read recently that openSUSE has reproducible builds now, or is very close to it.

I have not heard of "reproducible iso", rather of "reproducible builds" (https://en.wikipedia.org/wiki/Reproducible_builds).

Guix system does this. I know that people doing research like this because, with the exact same binaries, there is a good chance that the exact same input will produce the exact same output. I say good chance because I heard at least a case where, on different machines, even with the same binaries and the same input, the output was different (but I can't remember the details).

> I wanted to get it confirmed that reproducibility is not available.

It's not an all or nothing. Some packages are reproducible and some are not.

Here the main takeaway is probably that since Trisquel cares about reproducibility, volunteers are welcome to report bugs on specific packages and/or to help fixing these bugs (maintainers also don't have an infinite time).

And if you look in more details at the status of reproducibility, what "reproducible" means also varies a lot across time and distributions or operating systems.

The idea is to take 2 different setup and have some variations (like a different hostname, time of build, etc) and see if you can reproduce the same binary.

The problem is that the more variation you introduce, the more issues you can find, but the better is the quality of reproducibility.

So it's probably better to think about it as an ongoing effort rather than a problem that is done or not done. New languages get invented and new packages appear and they also need to be made reproducible.

If we compare Debian with Guix for instance, Guix is not 100% reproducible and doesn't have reproducible installation iso either because syslinux isn't reproducible in Guix, and there are key package like Guile that weren't reproducible last time I heard people talking about it, but it also takes the concept further than distributions like Debian and bootstrap compilers from source (with the meaning of source being bent a lot to include generated C code for instance like with vala) and so on.

And Guix is packaged in Trisquel so once you update it to avoid security issues (see the GNU Guix manual for that) you can try to see what is reproducible and what isn't, ideally accross different distributions (like Guix system, Trisquel, Parabola, etc).

In the case of Trisquel what is interesting is that it also compares with Ubuntu packages ( https://gitlab.com/debdistutils/reproduce/trisquel/ ) so you also get some cross distribution reproducibility and the amount of reproducible packages was about 34% between Trisquel and Ubuntu at the time of Trisquel 11.