Odyssey Linux — build recipes

The recipes used to build every package Odyssey publishes.

This repository exists so that anyone can rebuild a package and check that it matches what we shipped. It is deliberately kept apart from the package repository: a recipe that travelled with its own binary would prove nothing, because whoever could tamper with one could tamper with the other.

How to use it

Each published package has an entry in the signed manifest at repo.odysseylinux.org/odyssey-repo/x86_64/odyssey-challenge.json, which records — along with the checksum — the commit of this repository that contains the recipe used:

"recipe_commit": "a1b2c3d…"

To rebuild a package exactly as we did:

git clone https://code.odysseylinux.org/nobody/odyssey-recipes
cd odyssey-recipes
git checkout <recipe_commit>
cp -a srcpkgs/<package> /path/to/void-packages/srcpkgs/

Then build with SOURCE_DATE_EPOCH set to the value recorded in the manifest. The result should be byte-for-byte identical to what we published.

If it is not, that is worth telling us about — publicly.

What is in here

Only srcpkgs/<name>/: the template, its patches, and the files it installs. Nothing else. The upstream sources are not mirrored here — they are fetched from where the template says, with the checksum the template pins.

Attribution

Most recipes come from the Void Linux package tree and remain under its terms; our modifications are noted in the commit history. The idea of verifiable rebuilds is not ours either: it comes from the Reproducible Builds project.

Don't trust me. Verify me.