odyssey-challenge

Independent verification for Odyssey Linux packages.

Odyssey is maintained by one anonymous person. You are not asked to trust that person: every package is built from a public recipe, the build is reproducible, and each package's hash is published in a signed manifest. This tool lets you check that for yourself — and, if you want, rebuild a package from source and confirm it produces the exact same hash.

What it does

Every Odyssey package has its SHA-256 recorded in a signed manifest published at https://repo.odysseylinux.org/odyssey-repo/x86_64/odyssey-challenge.json. The manifest is signed with the maintainer's cosign key and logged in Sigstore's public Rekor transparency log.

odyssey-challenge has two modes:

• verify — for everyone. Downloads the signed manifest, verifies its signature, then checks that a package matches the published hash. Fast, no build toolchain required.
• rebuild — for advanced users / independent rebuilders. Rebuilds the package from the public recipe and confirms the resulting hash matches the manifest, then produces a signed attestation of your own that you can publish alongside the manifest. This is how independent parties vouch for a build without anyone having to trust a single source.

Requirements

• cosign, jq, curl, sha256sum (verify)
• additionally xbps-src (a checked-out void-packages) and your own cosign key pair (rebuild)

You also need the maintainer's public key. Get it independently of the package repo — from the keys repository:

git clone https://code.odysseylinux.org/nobody/odyssey-keys

Verifying the manifest with a key fetched from the same server that serves the manifest would prove nothing. Use a key from a separate source.

Usage

Verify a package (normal users)

./odyssey-challenge verify PACKAGE --pubkey /path/to/cosign.pub

This downloads the package and the signed manifest, checks the manifest signature, and compares hashes. A green VERIFIED means the package is exactly what the maintainer signed.

To check a file you already have:

./odyssey-challenge verify PACKAGE --file ./PACKAGE.xbps --pubkey cosign.pub

Rebuild from source (advanced)

Rebuilding a package byte for byte is done with Odyssey Challenge, the app shipped with the distribution. It is not available from this script, and the reason is worth knowing: a reproduction has to match four things exactly, or the result means nothing.

• the recipe, at the exact commit named in the manifest (recipe_commit)
• the timestamp, the same SOURCE_DATE_EPOCH the package was built with
• the toolchain, taken from the Odyssey repository rather than upstream Void, since a different compiler emits different code
• the build flags, the hardening and architecture flags published with each package in build_flags

Get any one of them wrong and you get a different binary from a perfectly honest recipe. The app prepares all four, then rebuilds, compares, and writes an attestation signed with your own key which you can publish.

Trust model

The manifest is the maintainer's own signed statement. Rebuilder attestations are separate files, each signed by its own author — they are never written into the maintainer's manifest. Trust does not come from one party's word; it comes from independent signed statements that anyone can compare. A signature can't be forged without its key, and a record in Rekor can't be silently removed.

Acknowledgements

The approach is inspired by guix challenge from GNU Guix, and more broadly by the work of the Reproducible Builds project (reproducible-builds.org), which established independent rebuild verification as a standard across distributions.

License

Public domain / CC0. Verify freely.