DEBIAN REQUIRES ALL PACKAGES TO BE REPRODUCIBLE

Reproducible builds ensure that software can be independently verified without trusting the distributor. This prevents malicious code injection during the build process and allows multiple parties to confirm that released binaries match published source code. The Debian project announced the requirement through its development mailing list, establishing a new standard for package distribution. Maintainers must now ensure their build processes are deterministic, eliminating non-reproducible elements like timestamps, random values, and build-specific paths. The move addresses a critical vulnerability in software supply chains. Recent high-profile attacks have exploited the difficulty of verifying that distributed binaries actually come from their claimed source code. Reproducible builds close this gap by enabling anyone with the source to verify authenticity. Implementation challenges remain, as some build tools and dependencies generate non-deterministic output by default. However, the Debian community has developed tooling and documentation to assist maintainers in achieving reproducibility across diverse package types and build systems.