Does the fedora-cisco-openh264 repo make Fedora to be not free? Is the repo content a binary blob? Implications?

[chrisawi (Chris Williams)]

Unexpected binary code from where? The package is built on Fedora infrastructure and signed by Fedora, so Cisco cannot modify it. Fedora package builds aren’t yet easily reproducible, but this package is no worse in that regard.

Report from the Reproducible Builds Hackfest during Flock 2023

This is a report and summary of my understanding for the Reproducible Builds Hackfest during Flock 2023 in Cork.[1][2] [Obligatory picture of local state] The goal is to have “reproducible builds” for rpms in Fedora and later the rest of the ecosystem. This would allow our users to be able to independently verify that the rpms have not been tampered with (either maliciously or by unreliable hardware): someone can do an independent rebuild of a package and confirm that they get identical binar…