Fedora As A Qubes Dependency(Supply Chain Attack)

[huaopeng]

Doesn’t the fact that Fedora is a QubesOS dependency, and it doesn’t have reproducible builds

make Fedora susceptible to a supply chain attack?

[huaopeng]

Wouldn’t the fact that Debian has reproducible builds make it a better candidate as the default template
instead of fedora?

[adw]

How is this not a duplicate of your other thread?

Reproducible Builds Fedora vs Debian

Should Qubes switch to using Debian instead of Fedora for key system templates like sys-usb, sys-net, sys-firewall ? Fedora does not currently compile and build using reproducible infrastructure.