Collaborative Working Sessions - Arch huddle

Making Arch Linux Debug Packages Reproducible

This should be handled in three different steps. There are questions remaining to be answered before proceeding with the integration.


  • Is debuginfod secure?
    • i.e. Is there authentication between gdb and debuginfod?

⚠️ It is theoretically possible to perform code execution through debug symbols.


  • Right now the debug packages live in a single server. We should start distributing them through mirrors and potentially have them in our archives as well.
    • There is a question about storage since debug packages might take a good amount of disk space.
    • “We shouldn’t let the limitations of mirrors affect our design choices”.


Here are the tools that needs integration: