[8organicbits]

Docker is slowly improving tooling for reproducible builds. I'm working in a blog post presently about how to do it. Reproducible images allow others to audit the build. If you're worried about third party build systems getting infected and injecting malware (unknown to the otherwise trustworthy publisher), this can help.

At the moment I'm rat-holing on apt package pinning, which doesn't work at all like I expected. Looking like I'm stuck between the Debian snapshot archive and vendoring .deb files (I don't like either).

Eventually this will go out on https://alexsci.com/blog/

[robertlagrant]

I'm with you. I thought Debian was much better at this, but it seems really tricky to do decent version pinning. I have new respect for NixOS.