I started wondering about the possibility of reproducible builds for distro live CDs. Suppose you have a set of packages where every binary is already reproducible — how much work is left to do?
So far the main finding is that mksquashfs with default options produced a file with a different hash sum literally every single time I tried.
I wonder if there's either SquashFS can be produced deterministically or there are alternative compressed read-only filesystems with that property.
#Tails was producing bit-for-bit reproducible live images, last I recall they had to massage somethings after processing it to make it work.
That said, not all the packages shipped in Tails are reproducible:
https://tests.reproducible-builds.org/debian/unstable/amd64/pkg_set_tails.html
You can make a #Reproducible iso out of not reproducible packages, as long as you use the same exact packages. :)
@vagrantc That's interesting, I need to take a look. Thanks for the pointer!