DEV TOOLS Signal 293 2 feeds carried it
New Buck2-based build system tine targets reproducible OS image builds
Daan De Meyer and Martin Pitt introduced tine, a Buck2-based build system designed for building operating systems with cryptographically verifiable integrity and reproducible builds.
tine addresses limitations in existing tools like mkosi, OBS, and BuildStream by providing a monorepo-based, hermetic build system that supports multiple distributions and produces bootable images with full input control. This matters for engineers building or maintaining operating system images who need reproducible, verifiable builds without heavy infrastructure dependencies.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
tine is a new Buck2-based build system focused on reproducible and hermetic OS builds
It supports multiple distributions and integrates package management with native image building
The system emphasizes monorepo-based iteration and caching for efficient development
THE READ
What the cluster adds up to.
The authors introduced tine as a new build system built on Buck2, aimed at constructing operating systems with cryptographically verifiable integrity. Unlike traditional build tools, tine was designed from the ground up to meet strict requirements around reproducibility, hermeticity, and control over all build inputs.
Existing tools like mkosi, OBS, and BuildStream were evaluated but found lacking in various ways. mkosi was deemed too restrictive for building multiple weakly related images, OBS required non-trivial server-side infrastructure, and BuildStream had concerns around bootstrapping and extensibility. tine was built to overcome these limitations.
A core requirement for tine was minimal host dependencies, allowing it to run in any environment without external setup. This self-contained nature makes it suitable for use in constrained or isolated build environments where installing additional tools is not feasible.
The system supports a monorepo-based workflow, enabling developers to make changes to any component, whether an imported RPM or a Go/Rust project, and immediately build and test across all images. This eliminates the need for intermediate commits or complex dependency declarations, streamlining the development cycle.
tine also emphasizes caching and scanner compatibility, ensuring that unchanged components can be retrieved from cache and that built images work with standard SBOM and security scanning tools like syft, grype, and trivy. These features make it practical for both development speed and security compliance.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER