Thomas Schmitt: > A new source of irreproducibility appeared: Future xorriso versions. > [...] > > I will of course try to keep such changes as rare as possible. But it > cannot be totally guaranteed that the same input data and options will > yield the same ISO with future versions of xorriso. > In case of a bug, i'd have few justification to preserve its consequences. > > The most obvious reason is the Preparer Id which xorriso writes into > the ISO by default. Current debian-cd ISOs have: > > XORRISO-1.3.6 2014.04.08.180000, LIBISOBURN-1.3.6, LIBISOFS-1.3.6, > LIBBURN-1.3.6 > > whereas currently uploaded GNU xorriso writes by default: > > XORRISO-1.4.5 2016.08.12.185822, LIBISOBURN-1.4.5, LIBISOFS-1.4.5, > LIBBURN-1.4.5 > > This can be overridden by classical mkisofs option -p. > E.g.: > > -p "Yoyodyne Reproducible ISO Maker and xorriso"
It obviously depends on the context in which xorriso is used but in general you need to fixate the version of your build depends anyway to archive reproducible builds (for example an updated compiler should be able to output better optimized code). So this should be no reproducibility problem. For Debian packages we are going to record the packages used to satisfy the build depends in so called .buildinfo files (see  for an example). : https://tests.reproducible-builds.org/debian/buildinfo/unstable/amd64/libisoburn_1.4.4-1_amd64.buildinfo
Description: OpenPGP digital signature
_______________________________________________ Reproducible-builds mailing list Reproducibleemail@example.com http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds