Accordin to a Tails dev, reproducible builds are not a requirement to be added to Debian. I thought the opposite, anybody can confirm?

for reference: gitlab.tails.boum.org/tails/tails/-/issues/17823#note_153118

Guest48395: debian has their own repro build system, whether upstream has repro builds or not.

Alright, but it's unclear to me if the GUI in its current state could have working reproducible builds on debian. I guess debian folks would have to work on that to make it work.

Or in other words: what should we do to have the GUI in Debian? Even if not in stabel, would be already something to have it on testing and unstable, as it is for the CLI

I don't really get his "you always need to trust the vendor in the end" argument

If part of the recommended user workflow is to verify hashes (with signatures), then this isn't the case

all the "vendor" (in this case, the download server) does here is provide bandwidth

And repro builds don't replace the need for quality review... they're part of defense in depth

We already ideally have multiple people review PRs... this is just the binary equivalent of that

That looks like the "it doesn't solve everything, therefore it's useless" argument.

I'd slap people who do this, except I do it myself from time to time...

The counterargument of "why would you _want_ a build that isn't the same every time" is an interesting one that I hadn't really specifically considered before, but I like it

moneromooo easy, just slap yourself sometimes too

Genius!