dlltool
's temp prefix so it generates reproducible files.dlltool
to initialize its output's .idata$6
section, avoiding random data ending up there.package-tree.html
produced by javadoc
.--no-insert-timestamps
be the default in binutils-mingw-w64? (Stephen Kitt)--deterministic
option to Tar? (Lunar)-flto -ffat-lto-objects
(Lunar)debian/changelog
entry, prevent gzip from storing a timestamp.debian/changelog
.__DATE__
and __TIME__
macros.#debian-reproducible
IRC channel if you want to be notified for your packages!
strip-nondeterminism development
Andrew Ayer fixed the gzip handler so that it skip adding a predetermined timestamp when there was none.
Documentation update
Lunar added documentation about mtimes of file extracted using unzip being timezone dependent. He also wrote a short example on how to test reproducibility.
Stephen Kitt updated the documentation about timestamps in PE binaries.
Documentation and scripts to perform weekly reports were published by Lunar.
Package reviews
50 obsolete
reviews have
been removed, 51 added and 29 updated this week. Thanks Chris West and Mathieu
Bridon amongst others.
New identified issues:
dh_installtex
.SOURCE_DATE_EPOCH
with a value suitable for gmtime(3).
debian/rules
in packages using it to produce HTML documentation.--mtime
when creating source tarball.HTML_TIMESTAMP
to NO
in Doxygen configuration file.HTML_TIMESTAMP
to NO
in Doxygen configuration file.Makefile.PL
.debbindiff
to be better understood. (h01ger)
debbindiff development
Reiner Herrmann added support for decompling Java .class
file and .ipk
package files (used by OpenWrt). This is now available in version 22 released on 2015-06-14.
Documentation update
Stephen Kitt
documented
the new --insert-timestamp
available since
binutils-mingw-w64 version 6.2
available to insert a ready-made date in PE binaries built with
mingw-w64.
Package reviews
195 obsolete
reviews have
been removed, 65 added and 126 updated this week.
New identified issues:
Provides: locales
but is actually missing some of the files provided by locales.
Coreboot upstream has been quick to react after the
announcement
of the tests set up the week
before. Patrick Georgi has fixed all issues in a couple of days and all
Coreboot images are now reproducible (without a payload).
SeaBIOS is one of the most frequently used payload
on PC hardware and can now be made
reproducible
too.
Paul Kocialkowski wrote to the mailing
list
asking for help on getting U-Boot tested for
reproducibility.
Lunar had a chat with maintainers of Open Build
Service to better
understand the difference between their system and what we are doing for
Debian.
pyuic
output imports in stable order. Original patch by Reiner Herrmann.zip
or unzip
.control.tar
. The patch has also been submitted based on the main branch.
Daniel Kahn Gillmor proposed a patch to add support for externally-supplying build date to help2man. This sparkled a discussion about agreeing on a common name for an environment variable to hold the date that should be used. It seems opinions are converging on using SOURCE_DATE_UTC
which would hold a ISO-8601 formatted date in UTC) (e.g. 2015-06-05T01:08:20Z
). Kudos to Daniel, Brendan O'Dea, Ximin Luo for pushing this forward.
Lunar proposed a patch to Tar upstream adding a --clamp-mtime
option as a generic solution for timestamp variations in tarballs which might also be useful for dpkg. The option changes the behavior of --mtime
to only use the time specified if the file mtime is newer than the given time. So far, upstream is not convinced that it would make a worthwhile addition to Tar, though.
Daniel Kahn Gillmor reached out to the libburnia project to ask for help on how to make ISO created with xorriso
reproducible. We should reward Thomas Schmitt with a model upstream trophy as he went through a thorough analysis of possible sources of variations and ways to improve the situation. Most of what is missing with the current version in Debian is available in the latest upstream version, but libisoburn in Debian needs help. Daniel backported the missing option for version 1.3.2-1.1.
akira submitted a new issue to Doxygen upstream regarding the timestamps added to the generated manpages.
Packages fixed
The following 49 packages became reproducible due to changes in their
build dependencies:
activemq-protobuf,
bnfc,
bridge-method-injector,
commons-exec,
console-data,
djinn,
github-backup,
haskell-authenticate-oauth,
haskell-authenticate,
haskell-blaze-builder,
haskell-blaze-textual,
haskell-bloomfilter,
haskell-brainfuck,
haskell-hspec-discover,
haskell-pretty-show,
haskell-unlambda,
haskell-x509-util,
haskelldb-hdbc-odbc,
haskelldb-hdbc-postgresql,
haskelldb-hdbc-sqlite3,
hasktags,
hedgewars,
hscolour,
https-everywhere,
java-comment-preprocessor,
jffi,
jgit,
jnr-ffi,
jnr-netdb,
jsoup,
lhs2tex,
libcolor-calc-perl,
libfile-changenotify-perl,
libpdl-io-hdf5-perl,
libsvn-notify-mirror-perl,
localizer,
maven-enforcer,
pyotherside,
python-xlrd,
python-xstatic-angular-bootstrap,
rt-extension-calendar,
ruby-builder,
ruby-em-hiredis,
ruby-redcloth,
shellcheck,
sisu-plexus,
tomcat-maven-plugin,
v4l2loopback,
vim-latexsuite.
The following packages became reproducible after getting fixed:
modified-by
option.__DATE__
and __TIME__
macros from source.debian/changelog
entry in manpage.debian/changelog
entry.HTML_TIMESTAMP
to NO
in Doxygen configuration.HTML_TIMESTAMP
to NO
in Doxygen configuration.HTML_TIMESTAMP
set to NO
.$datetime
from the file api_footer.html
.$datetime
from the file footer.html
.$PATH
. The second build will be done with a /i/capture/the/path
added. (Holger Levsen)
Holger Levsen with the help of Alexander Couzens wrote extra job to test the reproducibility of coreboot. Thanks James McCoy for helping with certificate issues.
Mattia Rizollo made some more internal improvements.
strip-nondeterminism development
Andrew Ayer released strip-nondeterminism/0.008-1. This new version fixes the gzip handler so that it now skip adding a predetermined timestamp when there was none.
Holger Levsen sponsored the upload.
Documentation update
The pages about timestamps in manpages generated by Doxygen, GHC .hi files, and Jar files have been updated to reflect their status in upstream.
Markus Koschany documented an easy way to prevent Doxygen to write timestamps in HTML output.
Package reviews
83 obsolete
reviews have
been removed, 71 added and 48 updated this week.
Meetings
A meeting was held on 2015-06-03. Minutes and full logs are available.
It was agreed to hold such a meeting every two weeks for the time being. The time of the next meeting should be announced soon.
unstable
are tested but also those in testing
and experimental
.--enable-deterministic-archives
flag. Making ar
, strip
and
others create deterministic static
libraries.dh_makeshlibs
(#774100), dh_icons
(#774102), dh_usrlocal
(#775020). Patches written
by Lunar.--no-include-build-time
option.
Patch by Jelmer
Vernooij.pidl
(from libparse-pidl-perl
) reproducible.-creation-date
to genisoimage
.
Reiner Herrmann opened #783938 to
request making -notimestamp
the default behavior for javadoc
.
Juan Picca submitted a patch to add a
--use-date
flag to texi2html
.
Packages fixed
The following packages became reproducible due to changes of their
build dependencies:
apport,
batctl,
cil,
commons-math3,
devscripts,
disruptor,
ehcache,
ftphs,
gtk2hs-buildtools,
haskell-abstract-deque,
haskell-abstract-par,
haskell-acid-state,
haskell-adjunctions,
haskell-aeson,
haskell-aeson-pretty,
haskell-alut,
haskell-ansi-terminal,
haskell-async,
haskell-attoparsec,
haskell-augeas,
haskell-auto-update,
haskell-binary-conduit,
haskell-hscurses,
jsch,
ledgersmb,
libapache2-mod-auth-mellon,
libarchive-tar-wrapper-perl,
libbusiness-onlinepayment-payflowpro-perl,
libcapture-tiny-perl,
libchi-perl,
libcommons-codec-java,
libconfig-model-itself-perl,
libconfig-model-tester-perl,
libcpan-perl-releases-perl,
libcrypt-unixcrypt-perl,
libdatetime-timezone-perl,
libdbd-firebird-perl,
libdbix-class-resultset-recursiveupdate-perl,
libdbix-profile-perl,
libdevel-cover-perl,
libdevel-ptkdb-perl,
libfile-tail-perl,
libfinance-quote-perl,
libformat-human-bytes-perl,
libgtk2-perl,
libhibernate-validator-java,
libimage-exiftool-perl,
libjson-perl,
liblinux-prctl-perl,
liblog-any-perl,
libmail-imapclient-perl,
libmocked-perl,
libmodule-build-xsutil-perl,
libmodule-extractuse-perl,
libmodule-signature-perl,
libmoosex-simpleconfig-perl,
libmoox-handlesvia-perl,
libnet-frame-layer-ipv6-perl,
libnet-openssh-perl,
libnumber-format-perl,
libobject-id-perl,
libpackage-pkg-perl,
libpdf-fdf-simple-perl,
libpod-webserver-perl,
libpoe-component-pubsub-perl,
libregexp-grammars-perl,
libreply-perl,
libscalar-defer-perl,
libsereal-encoder-perl,
libspreadsheet-read-perl,
libspring-java,
libsql-abstract-more-perl,
libsvn-class-perl,
libtemplate-plugin-gravatar-perl,
libterm-progressbar-perl,
libterm-shellui-perl,
libtest-dir-perl,
libtest-log4perl-perl,
libtext-context-eitherside-perl,
libtime-warp-perl,
libtree-simple-perl,
libwww-shorten-simple-perl,
libwx-perl-processstream-perl,
libxml-filter-xslt-perl,
libxml-writer-string-perl,
libyaml-tiny-perl,
mupen64plus-core,
nmap,
openssl,
pkg-perl-tools,
quodlibet,
r-cran-rjags,
r-cran-rjson,
r-cran-sn,
r-cran-statmod,
ruby-nokogiri,
sezpoz,
skksearch,
slurm-llnl,
stellarium.
The following packages became reproducible after getting fixed:
-DNO_VERSION_DATE
to build system.--use-date
to texi2html
.-creation-date
to
genisoimage
.debbindiff
output, missing build logs, unavailable build
dependencies.
Holger Levsen added a new execution environment to run debbindiff
using
dependencies from testing. This is required for packages built with
GHC as the compiler only understands interfaces built by the same
version.
debbindiff development
Version 17 has been uploaded to unstable. It now supports comparing
ISO9660 images, dictzip files and should compare identical files much
faster.
Documentation update
Various small updates and fixes to the pages about
PDF produced by LaTeX,
DVI produced by
LaTeX,
static
libraries,
Javadoc,
PE
binaries,
and Epydoc.
Package reviews
Known issues have been tagged when known to be deterministic as some
might unfortunately not show up on every single build.
For example, two new issues have been identified by building with one
timezone in April and one in May. RD
and help2man add current month and
year to the documentation they are producing.
1162 packages have been removed and 774 have been added in
the past week. Most of them are the work of proper automated
investigation done by Chris West.
Summer of code
Finally, we learned that both akira and Dhole were accepted for
this Google Summer of
Code.
Let's welcome them!
They have until May 25th before coding officialy begins. Now is the good time
to help them feel more comfortable by sharing all these little bits of
knowledge on how Debian works.
the problem is that user/group lookups are disabled in the -static build because glibc s NSS ABI is unstable and static binaries still need to load NSS modules dynamically.One solution here would be to compile against dietlibc, but for that we d need an ncurses library built against dietlibc (#471208), too.
Do you need Debian s zsh-static package? If so, please send an e-mail to us Debian Zsh Maintainers <pkg-zsh-devel@lists.alioth.debian.org> and state that you use zsh-static, and, if you want, please also state why or how you re using it. Thanks in advance! Mika, Frank, RichiH and Axel
the problem is that user/group lookups are disabled in the -static build because glibc s NSS ABI is unstable and static binaries still need to load NSS modules dynamically.One solution here would be to compile against dietlibc, but for that we d need an ncurses library built against dietlibc (#471208), too.
Do you need Debian s zsh-static package? If so, please send an e-mail to us Debian Zsh Maintainers <pkg-zsh-devel@lists.alioth.debian.org> and state that you use zsh-static, and, if you want, please also state why or how you re using it. Thanks in advance! Mika, Frank, RichiH and Axel
Next.