Reproduce it yourself. Then say so.
The public record of independent rebuilds. Every result below was signed by whoever produced it, and I cannot alter or delete a single one.
A signature proves who built a package. It does not prove the package was built honestly. I could compile something that has nothing to do with the published recipe, sign it with my own key, and every signature check in the world would come back green. That is the hole a signature cannot close.
What closes it is somebody else doing the build. If you take the published recipe, compile it on your own machine and get a package identical to mine down to the last byte, then whatever I did between source and binary, I did nothing extra. That is a challenge, and it is the strongest thing this project can offer, because it does not depend on believing me at all.
The idea is not mine. It comes from GNU Guix and its guix challenge, and more broadly from the Reproducible Builds project, which has been working on this since long before Odyssey existed. What I built is an Odyssey shaped version of it, with the tooling this distribution already uses.
Anyone can run it. Odyssey ships with Odyssey Challenge, which does the whole thing behind one button: it fetches my signed manifest, checks my signature against a key you get from somewhere I do not control, pulls the exact recipe, rebuilds, compares, and offers to publish what came out. You do not have to trust the app either, since it is open and every step is a command you could run by hand.
Results are published whether they match or not. A divergence is exactly as public, exactly as signed, and exactly as impossible for me to suppress as a confirmation. If somebody rebuilds a package and gets something different, that statement goes into the record and stays there, next to mine.
And they stay side by side, never merged. My manifest is my own signed statement about my own packages; your attestation is yours, signed with your key, standing next to mine. There is no shared file anyone can quietly edit, and no majority vote decides anything: the truth of a package is settled by its hash, not by counting.
It does not prove the upstream source is clean. A rebuild says the binary matches the recipe, not that the recipe pulls in something harmless. That is what the scanning stage is for, and it is a separate argument on the security page.
It does not prove the compiler is clean, since a rebuild uses the same toolchain I use. Proving that is the bootstrappable builds problem, and no distribution has fully solved it.
And for packages that are repacks of vendor binaries, it proves my packaging is clean, not that the vendor's build was.
Comparing a package against the signed manifest needs nothing special, and works from any Linux machine.
# the tool curl -LO https://code.odysseylinux.org/nobody/odyssey-challenge/raw/branch/main/odyssey-challenge chmod +x odyssey-challenge # the key, from the keys repo and not from the package server git clone https://code.odysseylinux.org/nobody/odyssey-keys # verify ./odyssey-challenge verify PACKAGE --pubkey odyssey-keys/cosign.pub → VERIFIED # the package is exactly what was signed → MISMATCH # do not install it, and tell me
Already have the file? Add --file ./PACKAGE.xbps and it checks that one instead of downloading again.
Rebuilding is done with Odyssey Challenge, the app that ships with the distribution. It is deliberately not a shell command, because a reproduction has to match four things exactly and getting one wrong produces a mismatch that means nothing:
the recipe at the commit the manifest names, the same SOURCE_DATE_EPOCH, the toolchain from the Odyssey repository rather than upstream Void, and the build flags published with the package.
The app prepares all four in a build tree kept separate from anything else on your machine, rebuilds, compares, and writes an attestation signed with a key that is yours alone. Then you decide whether to publish it.
One signed file lists every package with its hash and everything needed to reproduce it.
https://repo.odysseylinux.org/odyssey-repo/x86_64/odyssey-challenge.json https://repo.odysseylinux.org/odyssey-repo/x86_64/odyssey-challenge.json.cosign.bundle
Check its signature before trusting anything in it, with the key from the keys repository. A manifest and the key that verifies it must never come from the same place.
verify means somebody downloaded the package and confirmed its hash matches the signed manifest. It proves the file reached them untouched, on the server and in transit. It takes seconds and needs no build tools.
rebuild means somebody compiled the package from the published recipe and got the same bytes. It proves far more: that the binary really comes from the source, with nothing inserted in between. It is the result worth having.
An empty record for a package means nobody has checked it yet. It does not mean anything is wrong, and it does not mean anything is right. Absence is not evidence, which is exactly why results are published either way.
Every attestation is signed with a key its author holds and nobody else does, and each signature is recorded in Rekor, the public append only log run by Sigstore under the Linux Foundation. I do not operate that log and I cannot remove anything from it.
So an attestation cannot be forged without its key, and cannot be silently deleted once made. Flooding the record with false results is possible, but pointless: anyone can download the package, compute the hash, and see which side is telling the truth. Nothing here is decided by how many say what.