Debian Starts Blocking Non-Reproducible Packages From Testing, Making Bit-Identical Builds a Hard Gate for Forky
Debian's release team has switched on a migration block for any package that fails to build reproducibly, with 98.29% of architecture-independent packages already passing.
Overview
Debian’s release team has begun blocking non-reproducible packages from migrating into the project’s testing branch, turning what had been a long-running quality goal into a hard gate for the next stable release. The change was announced on May 10 by Paul Gevers on the debian-devel-announce mailing list and took effect a day earlier, on May 9, during the Forky development cycle, It’s FOSS reported.
What We Know
In his “bits from the release team” note, Gevers wrote that “Debian must ship reproducible packages” and confirmed that “since yesterday, we have enabled our migration software to block migration of new packages that can’t be reproduced,” calling the switch “a small step in code, but a giant leap in commitment,” according to the mailing-list message. The block also applies to packages already in testing whose reproducibility regresses, Linuxiac reported.
Reproducible builds are the practice of generating bit-identical binary packages from identical source code in the same build environment, heise online explained. The point is independent verifiability: anyone with the source and the recorded build metadata should be able to rebuild a package and confirm bit-for-bit that the binary Debian ships matches what the source produced, per It’s FOSS.
The project’s tracking dashboard at reproduce.debian.net continuously rebuilds packages using the .buildinfo files recorded by the original buildds and compares the outputs bit-for-bit, Linuxiac reported. At the time of the announcement, 98.29% of architecture-independent packages were reproducing successfully, with 23,731 packages passing the check and 414 still flagged as failing, according to It’s FOSS.
The gate is specific to Debian 14, codenamed Forky, which Linuxiac reported is expected in mid-2027. Currently stable releases are unaffected by the new requirement, Linuxiac noted.
The same release-team message announced a second migration-software change: autopkgtests are now run against binary-only non-maintainer uploads (binNMUs) during migration, matching the automated-test rigor previously applied only to source uploads, per heise online and the release-team note. Gevers also flagged the recent addition of the loong64 architecture to the archive, writing that “because we only allow binaries built on the buildds to migrate and because of multi-arch requirements, we had to rebuild quite a few packages,” which has temporarily lengthened build queues, according to the mailing-list message.
Responsibility for clearing the bar lands on package maintainers. “It is the responsibility of the uploader of a source package to ensure that it migrates,” Gevers wrote, and when autopkgtest regressions in reverse dependencies block a package, maintainers are expected to file release-critical bugs, per the release-team message.
What We Don’t Know
The announcement does not set a numerical target for the 414 architecture-independent packages still failing reproducibility, nor does it specify what happens if maintainers cannot fix them in time for Forky’s freeze. The release team’s note frames the migration block as the structural lever rather than naming individual laggards.
The coverage available so far also does not break out architecture-dependent reproducibility, where rates and counts differ from the architecture-independent figures cited above. The 98.29%, 23,731, and 414 numbers apply specifically to architecture-independent packages as reported by It’s FOSS; the broader picture across all architectures is described only as “over 98%” by Linuxiac.
Why It Matters
Reproducible builds have been a long-running goal of the Debian Reproducible Builds project, but the new migration block converts that objective into a release-engineering requirement: a package that cannot be rebuilt bit-for-bit cannot reach Debian users in Forky. That changes the incentives for the long tail of packages whose non-reproducibility stems from baked-in timestamps, build-host hostnames, file orderings, or other environmental noise.
The shift also lands in a year shaped by repeated supply-chain compromises of developer tooling and CI systems, including the Checkmarx Jenkins AST plugin backdoor disclosed earlier this week. Bit-identical, independently verifiable binaries do not prevent a malicious upstream commit, but they remove a class of attack in which a tampered build host produces binaries that no third party can detect by re-running the build. With Forky’s migration software now enforcing the property, Debian moves from publishing reproducibility as a goal to refusing to ship without it.