At Tails, we have worked during a year to implement such a set of practices. This makes it now possible to compare ISO images built by multiple parties from the same source code and Debian packages, and to ensure that they all result in exactly the same ISO image.
This does not change anything in the way you download and install Tails, and you don't have to make additional verifications. It simply helps trust that the Tails ISO image that we distribute is indeed coming from the source code and Debian packages it is meant to be made of.With reproducible Tails, it only takes one knowledgeable person to build Tails and compare with the ISO image the Tails project distributes to uncover some kinds of backdoors.
Any reproducible build process is reproducible… until proven otherwise. In our case last-minute issues were discovered and should be fixed in the next Tails release:
