apt-get install tftpd-hpa). # apt-get install u-boot-tools
$ cat vmlinuz armada-370-netgear-rn104.dtb > vmlinuz-rn104
$ mkimage -A arm -O linux -T multi -C none -a 0x04000000 -e 0x04000000 -n "Debian Jessie armhf installer" -d vmlinuz-rn104:initrd.gz uImage-installer-rn104
# cp uImage-installer-rn104 /srv/tftp
dhcp
setenv serverip 192.168.1.17
tftp uImage-installer-rn104
bootm $load_addr
192.168.1.17 being the IPv4 of the machine you set up the tftp server
above, adapt accordingly to your setup.
While in U-Boot the default ethernet device is the lower jack, the installer is
only able to use the upper, so replug the ethernet cable to the upper
receptacle.
Go through the installation, and before rebooting do the following:
Select "Change debconf priority" and set it to "low". Then "Download installer components" and check "mtd-modules-3.16.0-4-armmp-di". After that "Execute a shell" and do:
# depmod -a
# modprobe pxa3xx_nand
# apt-install flash-kernel
# mount --bind /proc /target/proc
# chroot /target
# cat >> /etc/flash-kernel/db << EOF
Machine: NETGEAR ReadyNAS 104
DTB-Id: armada-370-netgear-rn104.dtb
DTB-Append: yes
Mtd-Kernel: uImage
Mtd-Initrd: minirootfs
U-Boot-Kernel-Address: 0x04000000
U-Boot-Initrd-Address: 0x05000000
Required-Packages: u-boot-tools
EOF
# flash-kernel
Bootloader-Sets-Incorrect-Root: yes to
/etc/flash-kernel/db.
[1] Note this page is about a ReadyNAS 102, the pinout is identical though.
What happened in the reproducible
builds effort this week:
Toolchain fixes
Aur lien Jarno uploaded glibc/2.21-0experimental1 which will fix the issue were locales-all did not behave exactly like locales despite having it in the Provides field.
Lunar rebased the pu/reproducible_builds branch for dpkg on top of the released 1.18.2. This made visible an issue with udebs and automatically generated debug packages.
The summary from the meeting at DebConf15 between ftpmasters, dpkg mainatainers and reproducible builds folks has been posted to the revelant mailing lists.
Packages fixed
The following 70 packages became reproducible due to changes in their
build dependencies:
activemq-activeio,
async-http-client,
classworlds,
clirr,
compress-lzf,
dbus-c++,
felix-bundlerepository,
felix-framework,
felix-gogo-command,
felix-gogo-runtime,
felix-gogo-shell,
felix-main,
felix-shell-tui,
felix-shell,
findbugs-bcel,
gco,
gdebi,
gecode,
geronimo-ejb-3.2-spec,
git-repair,
gmetric4j,
gs-collections,
hawtbuf,
hawtdispatch,
jack-tools,
jackson-dataformat-cbor,
jackson-dataformat-yaml,
jackson-module-jaxb-annotations,
jmxetric,
json-simple,
kryo-serializers,
lhapdf,
libccrtp,
libclaw,
libcommoncpp2,
libftdi1,
libjboss-marshalling-java,
libmimic,
libphysfs,
libxstream-java,
limereg,
maven-debian-helper,
maven-filtering,
maven-invoker,
mochiweb,
mongo-java-driver,
mqtt-client,
netty-3.9,
openhft-chronicle-queue,
openhft-compiler,
openhft-lang,
pavucontrol,
plexus-ant-factory,
plexus-archiver,
plexus-bsh-factory,
plexus-cdc,
plexus-classworlds2,
plexus-component-metadata,
plexus-container-default,
plexus-io,
pytone,
scolasync,
sisu-ioc,
snappy-java,
spatial4j-0.4,
tika,
treeline,
wss4j,
xtalk,
zshdb.
The following packages became reproducible after getting fixed:
pybuild to get rid of .pyc files.SOURCE_DATE_EPOCH.dpkg-parsechangelog in debian/rules.SOURCE_DATE_EPOCH for version string.SOURCE_DATE_EPOCH to set manpage date.scm-safe which tells ResourceGen that no timestamps should be included.SOURCE_DATE_EPOCH have been improved to support systems without GNU date.
reproducible.debian.net
armhf is finally being tested, which also means the remote building of Debian packages finally works! This paves the way to perform the tests on even more architectures and doing variations on CPU and date. Some packages even produce the same binary Arch:all packages on different architectures (1, 2). (h01ger)
Tests for FreeBSD are finally running. (h01ger)
As it seems the gcc5 transition has cooled off, we schedule sid more often than testing again on amd64. (h01ger)
disorderfs has been built and installed on all build nodes (amd64 and armhf). One issue related to permissions for root and unpriviliged users needs to be solved before disorderfs can be used on reproducible.debian.net. (h01ger)
strip-nondeterminism
Version 0.011-1 has been released on August 29th. The new version updates dh_strip_nondeterminism to match recent changes in debhelper. (Andrew Ayer)
disorderfs
disorderfs, the new FUSE filesystem to ease testing of filesystem-related variations, is now almost ready to be used. Version 0.2.0 adds support for extended attributes. Since then Andrew Ayer also added support to reverse directory entries instead of shuffling them, and arbitrary padding to the number of blocks used by files.
Package reviews
142 reviews have
been removed, 48 added and 259 updated this week.
Santiago Vila renamed the not_using_dh_builddeb issue into varying_mtimes_in_data_tar_gz_or_control_tar_gz to align better with other tag names.
New issue identified this week: random_order_in_python_doit_completion.
37 FTBFS issues have been reported by Chris West (Faux) and Chris Lamb.
Misc.
h01ger gave a talk at FrOSCon on August 23rd. Recordings are already online.
These reports are being reviewed and enhanced every week by many people hanging out on #debian-reproducible. Huge thanks!
Well, here are the stats for the final week of the DUCK challenge as well as DebConf15:
| Week 1 | Week 2 | Week 3 | Week 4 | Week 5 | Week 6 | Week 7 | |
|---|---|---|---|---|---|---|---|
| # Packages | 10 | 15 | 10 | 14 | 10 | 9 | 21 |
| Total | 10 | 25 | 35 | 49 | 59 | 68 | 89 |
Pevious articles are here: Week 1, Week 2, Week 3, Week 4, Week 5,Week 6.
Slighthly delayed, but here are the stats for week 5 of the DUCK challenge:
| Week 1 | Week 2 | Week 3 | Week 4 | Week 5 | Week 6 | Week 7 | |
|---|---|---|---|---|---|---|---|
| # Packages | 10 | 15 | 10 | 14 | 10 | - | - |
| Total | 10 | 25 | 35 | 49 | 59 | - | - |
What happened in the reproducible
builds effort this week:
Toolchain fixes
Eric Dorlan uploaded automake-1.15/1:1.15-2 which makes the output of mdate-sh deterministic. Original patch by Reiner Herrmann.
Kenneth J. Pronovici uploaded epydoc/3.0.1+dfsg-8 which now honors SOURCE_DATE_EPOCH. Original patch by Reiner Herrmann.
Chris Lamb submitted a patch to dh-python to make the order of the generated maintainer scripts deterministic. Chris also offered a fix for a source of non-determinism in dpkg-shlibdeps when packages have alternative dependencies.
Dhole provided a patch to add support for SOURCE_DATE_EPOCH to gettext.
Packages fixed
The following 78 packages became reproducible in our setup due to changes in their
build dependencies:
chemical-mime-data,
clojure-contrib,
cobertura-maven-plugin,
cpm,
davical,
debian-security-support,
dfc,
diction,
dvdwizard,
galternatives,
gentlyweb-utils,
gifticlib,
gmtkbabel,
gnuplot-mode,
gplanarity,
gpodder,
gtg-trace,
gyoto,
highlight.js,
htp,
ibus-table,
impressive,
jags,
jansi-native,
jnr-constants,
jthread,
jwm,
khronos-api,
latex-coffee-stains,
latex-make,
latex2rtf,
latexdiff,
libcrcutil,
libdc0,
libdc1394-22,
libidn2-0,
libint,
libjava-jdbc-clojure,
libkryo-java,
libphone-ui-shr,
libpicocontainer-java,
libraw1394,
librostlab-blast,
librostlab,
libshevek,
libstxxl,
libtools-logging-clojure,
libtools-macro-clojure,
litl,
londonlaw,
ltsp,
macsyfinder,
mapnik,
maven-compiler-plugin,
mc,
microdc2,
miniupnpd,
monajat,
navit,
pdmenu,
pirl,
plm,
scikit-learn,
snp-sites,
sra-sdk,
sunpinyin,
tilda,
vdr-plugin-dvd,
vdr-plugin-epgsearch,
vdr-plugin-remote,
vdr-plugin-spider,
vdr-plugin-streamdev,
vdr-plugin-sudoku,
vdr-plugin-xineliboutput,
veromix,
voxbo,
xaos,
xbae.
The following packages became reproducible after getting fixed:
LC_ALL=C when running sort.TZ=UTC when calling unzip.Makefile.debian/changelog in version string.TZ=UTC when calling unzip.TZ=UTC when calling unzip.TZ=UTC when calling unzip.TZ=UTC when calling unzip.TZ=UTC when calling unzip.debian/changelog in manpages.*.pyo and *.pyc from binary package.debian/changelog when generating version strings.debian/changelog.freebsd-hackers mailing list. The build is run on a new virtual machine running FreeBSD 10.1 with 3 cores and 6 GB of RAM, also sponsored by Profitbricks.
strip-nondeterminism development
Andrew Ayer released version 0.009 of strip-nondeterminism. The new version will strip locales from Javadoc, include the name of files causing errors, and ignore unhandled (but rare) zip64 archives.
debbindiff development
Lunar continued its major refactoring to enhance code reuse and pave the way to fuzzy-matching and parallel processing. Most file comparators have now been converted to the new class hierarchy.
In order to support for archive formats, work has started on packaging Python bindings for libarchive. While getting support for more archive formats with a common interface is very nice, libarchive is a stream oriented library and might have bad performance with how debbindiff currently works. Time will tell if better solutions need to be found.
Documentation update
Lunar started a Reproducible builds HOWTO intended to explain the different aspects of making software build reproducibly to the different audiences that might have to get involved like software authors, producers of binary packages, and distributors.
Package reviews
17 obsolete
reviews have
been removed, 212 added and 46 updated this week.
15 new bugs for packages failing to build from sources have been reported by Chris West (Faux), and Mattia Rizzolo.
Presentations
Lunar presented Debian efforts and some recipes on making software build reproducibly at Libre Software Meeting 2015. Slides and a video recording are available.
Misc.
h01ger, dkg, and Lunar attended a Core Infrastructure Initiative meeting. The progress and tools mode for the Debian efforts were shown. Several discussions also helped getting a better understanding of the needs of other free software projects regarding reproducible builds. The idea of a global append only log, similar to the logs used for Certificate Transparency, came up on multiple occasions. Using such append only logs for keeping records of sources and build results has gotten the name Binary Transparency Logs . They would at least help identifying a compromised software signing key. Whether the benefits in using such logs justify the costs need more research.
What happened about the reproducible
builds effort this week:
Media coverage
Daniel Stender published an English translation of the article which originally
appeared in Linux Magazin in Admin Magazine.
Toolchain fixes
Fixes landed in the Debian archive:
--clamp-mtime option to tar.
Patches have been submitted to add support for SOURCE_DATE_EPOCH to txt2man (Reiner Herrmann), epydoc (Reiner Herrmann), GCC (Dhole), and Doxygen (akira).
Dhole uploaded a new experimental debhelper to the reproducible repository which exports SOURCE_DATE_EPOCH. As part of the experiment, the patch also sets TZ to UTC which should help with most timezone issues. It might still be problematic for some packages which would change their settings based on this.
Mattia Rizzolo sent upstream a patch originally written by Lunar to make the generate-id() function be deterministic in libxslt. While that patch was quickly rejected by upstream, Andrew Ayer came up with a much better one which sadly could have some performance impact. Daniel Veillard replied with another patch that should be deterministic in most cases without needing extra data structures. It's impact is currently being investigated by retesting packages on reproducible.debian.net.
akira added a new option to sbuild for configuring the path in which packages are built. This will be needed for the srebuild script.
Niko Tyni asked Perl upstream about it using the __DATE__ and __TIME__ C processor macros.
Packages fixed
The following 143 packages became reproducible due to changes in their
build dependencies:
alot,
argvalidate,
astroquery,
blender,
bpython,
brian,
calibre,
cfourcc,
chaussette,
checkbox-ng,
cloc,
configshell,
daisy-player,
dipy,
dnsruby,
dput-ng,
dsc-statistics,
eliom,
emacspeak,
freeipmi,
geant321,
gpick,
grapefruit,
heat-cfntools,
imagetooth,
jansson,
jmapviewer,
lava-tool,
libhtml-lint-perl,
libtime-y2038-perl,
lift,
lua-ldoc,
luarocks,
mailman-api,
matroxset,
maven-hpi-plugin,
mknbi,
mpi4py,
mpmath,
msnlib,
munkres,
musicbrainzngs,
nova,
pecomato,
pgrouting,
pngcheck,
powerline,
profitbricks-client,
pyepr,
pylibssh2,
pylogsparser,
pystemmer,
pytest,
python-amqp,
python-apt,
python-carrot,
python-crypto,
python-darts.lib.utils.lru,
python-demgengeo,
python-graph,
python-mock,
python-musicbrainz2,
python-pathtools,
python-pskc,
python-psutil,
python-pypump,
python-repoze.sphinx.autointerface,
python-repoze.tm2,
python-repoze.what-plugins,
python-repoze.what,
python-repoze.who-plugins,
python-xstatic-term.js,
reclass,
resource-agents,
rgain,
rttool,
ruby-aggregate,
ruby-archive-tar-minitar,
ruby-bcat,
ruby-blankslate,
ruby-coffee-script,
ruby-colored,
ruby-dbd-mysql,
ruby-dbd-odbc,
ruby-dbd-pg,
ruby-dbd-sqlite3,
ruby-dbi,
ruby-dirty-memoize,
ruby-encryptor,
ruby-erubis,
ruby-fast-xs,
ruby-fusefs,
ruby-gd,
ruby-git,
ruby-globalhotkeys,
ruby-god,
ruby-hike,
ruby-hmac,
ruby-integration,
ruby-ipaddress,
ruby-jnunemaker-matchy,
ruby-memoize,
ruby-merb-core,
ruby-merb-haml,
ruby-merb-helpers,
ruby-metaid,
ruby-mina,
ruby-net-irc,
ruby-net-netrc,
ruby-odbc,
ruby-packet,
ruby-parseconfig,
ruby-platform,
ruby-plist,
ruby-popen4,
ruby-rchardet,
ruby-romkan,
ruby-rubyforge,
ruby-rubytorrent,
ruby-samuel,
ruby-shoulda-matchers,
ruby-sourcify,
ruby-test-spec,
ruby-validatable,
ruby-wirble,
ruby-xml-simple,
ruby-zoom,
ryu,
simplejson,
spamassassin-heatu,
speaklater,
stompserver,
syncevolution,
syncmaildir,
thin,
ticgit,
tox,
transmissionrpc,
vdr-plugin-xine,
waitress,
whereami,
xlsx2csv,
zathura.
The following packages became reproducible after getting fixed:
debian/changelog entry as build datedebian/changelog entry.#defines..
-i/--issues: schedule all packages affected by the given issue.-r/--status: schedule all packages with the given status.-b/--before: schedule all packages built before the given date-t/--after: schedule all packages built after the given date.--noisy: notify the IRC channel also when the build starts, with a URL to watch it in real time. What happened about the reproducible
builds effort this week:
Toolchain fixes
Norbert Preining uploaded texinfo/6.0.0.dfsg.1-2 which makes texinfo indices reproducible. Original patch by Chris Lamb.
Lunar submitted recently rebased patches to make the file order of files inside .deb stable.
akira filled #789843 to make tex4ht stop printing timestamps in its HTML output by default.
Dhole wrote a patch for xutils-dev to prevent timestamps when creating gzip compresed files.
Reiner Herrmann sent a follow-up patch for wheel to use UTC as timezone when outputing timestamps.
Mattia Rizzolo started a discussion regarding the failure to build from source of subversion when -Wdate-time is added to CPPFLAGS which happens when asking dpkg-buildflags to use the reproducible profile. SWIG errors out because it doesn't recognize the aforementioned flag.
Trying to get the .buildinfo specification to more definitive state, Lunar started a discussion on storing the checksums of the binary package used in dpkg status database.
akira discovered while proposing a fix for simgrid that CMake internal command to create tarballs would record a timestamp in the gzip header. A way to prevent it is to use the GZIP environment variable to ask gzip not to store timestamps, but this will soon become unsupported. It's up for discussion if the best place to fix the problem would be to fix it for all CMake users at once.
Infrastructure-related work
Andreas Henriksson did a delayed NMU upload of pbuilder which adds minimal support for build profiles and includes several fixes from Mattia Rizzolo affecting reproducibility tests.
Neils Thykier uploaded lintian which both raises the severity of package-contains-timestamped-gzip and avoids false positives for this tag (thanks to Tomasz Buchert).
Petter Reinholdtsen filled #789761 suggesting that how-can-i-help should prompt its users about fixing reproducibility issues.
Packages fixed
The following packages became reproducible due to changes in their
build dependencies:
autorun4linuxcd,
libwildmagic,
lifelines,
plexus-i18n,
texlive-base,
texlive-extra,
texlive-lang.
The following packages became reproducible after getting fixed:
debian/changelog entry.CMakeLists.txt to give GZIP=-n for tar.__DATE__ and __TIME__ macros.HTML_TIMESTAMP=NO in Doxygen configuration.HTML_TIMESTAMP=NO to Doxygen.$datetime from footer.html used by Doxygen.HTML_TIMESTAMP=NO in Doxygen configuration.$Storable::canonical = 1 to make space_groups.db.PL output deterministic.HTML_TIMESTAMP=NO in Doxygen configuration.HTML_TIMESTAMP=NO in Doxygen configuration.HTML_TIMESTAMP=NO in Doxygen configuration.HTML_TIMESTAMP=NO in Doxygen configuration.HTML_TIMESTAMP=NO in Doxygen configuration.$datetime from the footer.HTML_TIMESTAMP=NO in Doxygen configuration.LC_ALL to C before sorting.debian/changelog as build datejavap, readelf, objdump, zipinfo, unsqusahfs; useless MD5 checksum and last modified date in javap output; bad handling of charsets in PO files; the destination path for gzip compressed files not ending in .gz; only metadata of cpio archives were actually compared. stat output was further trimmed to make directory comparison more useful.
Having the test suite enabled a refactoring of how comparators were written, switching from a forest of differences to a single tree. This helped removing dust from the oldest parts of the code.
Together with some other small changes, version 25 was released on June 27th. A follow up release was made the next day to fix a hole in the test suite and the resulting unidentified leftover from the comparator refactoring. (Lunar)
Documentation update
Ximin Luo improved code examples for some proposed environment variables for reference timestamps. Dhole added an example on how to fix timestamps C pre-processor macros by adding a way to set the build date externally. akira documented her fix for tex4ht timestamps.
Package reviews
94 obsolete
reviews have
been removed, 330 added and 153 updated this week.
Hats off for Chris West (Faux) who investigated many fail to build from source issues and reported the relevant bugs.
Slight improvements were made to the scripts for editing the review database, edit-notes and clean-notes. (Mattia Rizzolo)
Meetings
A meeting was held on June 23rd. Minutes are available.
The next meeting will happen on Tuesday 2015-07-07 at 17:00 UTC.
Misc.
The Linux Foundation announced that it was funding the work of Lunar and h01ger on reproducible builds in Debian and other distributions. This was further relayed in a Bits from Debian blog post.
What happened about the reproducible
builds effort this week:
Toolchain fixes
SOURCE_DATE_EPOCH for the date for the generated pages.en_US when generating the javadoc.en_US when generating the javadoc.LC_ALL=C.debian/changelog.debian/changelog.$datetime from the documentation footer.$date from the documentation footer.HTML_TIMESTAMP=NO in Doxygen configuration.HTML_TIMESTAMP=NO in Doxygen configuration.HTML_TIMESTAMP=NO in Doxygen configuration.$datetime from the documentation footer.HTML_TIMESTAMP=NO in Doxygen configuration.$datetime from the documentation footer.HTML_TIMESTAMP=NO in Doxygen configuration.HTML_TIMESTAMP=NO to Doxygen.$datetime from the documentation footer.HTML_TIMESTAMP=NO to Doxygen.dh_fixperms even when overriding dh_fixperms.HTML_TIMESTAMP=NO in Doxygen configuration.HTML_TIMESTAMP=NO in Doxygen configuration.HTML_TIMESTAMP=NO in Doxygen configuration.HTML_TIMESTAMP=NO in Doxygen configuration.HTML_TIMESTAMP=NO to Doxygen. What happened about the reproducible
builds effort for this week:
Toolchain fixes
Uploads that should help other packages:
dlltool's temp prefix so it generates reproducible files.dlltool to initialize its output's .idata$6 section, avoiding random data ending up there.package-tree.html produced by javadoc.--no-insert-timestamps be the default in binutils-mingw-w64? (Stephen Kitt)--deterministic option to Tar? (Lunar)-flto -ffat-lto-objects (Lunar)debian/changelog entry, prevent gzip from storing a timestamp.debian/changelog.__DATE__ and __TIME__ macros.#debian-reproducible IRC channel if you want to be notified for your packages!
strip-nondeterminism development
Andrew Ayer fixed the gzip handler so that it skip adding a predetermined timestamp when there was none.
Documentation update
Lunar added documentation about mtimes of file extracted using unzip being timezone dependent. He also wrote a short example on how to test reproducibility.
Stephen Kitt updated the documentation about timestamps in PE binaries.
Documentation and scripts to perform weekly reports were published by Lunar.
Package reviews
50 obsolete
reviews have
been removed, 51 added and 29 updated this week. Thanks Chris West and Mathieu
Bridon amongst others.
New identified issues:
What happened about the reproducible
builds effort for this week:
Presentations
On June 7th, Reiner Herrmann
presented the project at the
Gulaschprogrammiernacht 15 in Karlsruhe, Germany.
Video and audio
recordings
in German are available, and so are the slides in
English.
Toolchain fixes
dh_installtex.SOURCE_DATE_EPOCH with a value suitable for gmtime(3).
debian/rules in packages using it to produce HTML documentation.--mtime when creating source tarball.HTML_TIMESTAMP to NO in Doxygen configuration file.HTML_TIMESTAMP to NO in Doxygen configuration file.Makefile.PL.debbindiff to be better understood. (h01ger)
debbindiff development
Reiner Herrmann added support for decompling Java .class file and .ipk package files (used by OpenWrt). This is now available in version 22 released on 2015-06-14.
Documentation update
Stephen Kitt
documented
the new --insert-timestamp available since
binutils-mingw-w64 version 6.2
available to insert a ready-made date in PE binaries built with
mingw-w64.
Package reviews
195 obsolete
reviews have
been removed, 65 added and 126 updated this week.
New identified issues:
Provides: locales but is actually missing some of the files provided by locales.
Coreboot upstream has been quick to react after the
announcement
of the tests set up the week
before. Patrick Georgi has fixed all issues in a couple of days and all
Coreboot images are now reproducible (without a payload).
SeaBIOS is one of the most frequently used payload
on PC hardware and can now be made
reproducible
too.
Paul Kocialkowski wrote to the mailing
list
asking for help on getting U-Boot tested for
reproducibility.
Lunar had a chat with maintainers of Open Build
Service to better
understand the difference between their system and what we are doing for
Debian.
What happened about the reproducible
builds effort for this week:
Presentations
On May 26th,Holger Levsen presented reproducible builds in Debian at CCC Berlin for the Datengarten 52. The presentation was in German and the slides in English. Audio and video recordings are available.
Toolchain fixes
pyuic output imports in stable order. Original patch by Reiner Herrmann.zip or unzip.control.tar. The patch has also been submitted based on the main branch.
Daniel Kahn Gillmor proposed a patch to add support for externally-supplying build date to help2man. This sparkled a discussion about agreeing on a common name for an environment variable to hold the date that should be used. It seems opinions are converging on using SOURCE_DATE_UTC which would hold a ISO-8601 formatted date in UTC) (e.g. 2015-06-05T01:08:20Z). Kudos to Daniel, Brendan O'Dea, Ximin Luo for pushing this forward.
Lunar proposed a patch to Tar upstream adding a --clamp-mtime option as a generic solution for timestamp variations in tarballs which might also be useful for dpkg. The option changes the behavior of --mtime to only use the time specified if the file mtime is newer than the given time. So far, upstream is not convinced that it would make a worthwhile addition to Tar, though.
Daniel Kahn Gillmor reached out to the libburnia project to ask for help on how to make ISO created with xorriso reproducible. We should reward Thomas Schmitt with a model upstream trophy as he went through a thorough analysis of possible sources of variations and ways to improve the situation. Most of what is missing with the current version in Debian is available in the latest upstream version, but libisoburn in Debian needs help. Daniel backported the missing option for version 1.3.2-1.1.
akira submitted a new issue to Doxygen upstream regarding the timestamps added to the generated manpages.
Packages fixed
The following 49 packages became reproducible due to changes in their
build dependencies:
activemq-protobuf,
bnfc,
bridge-method-injector,
commons-exec,
console-data,
djinn,
github-backup,
haskell-authenticate-oauth,
haskell-authenticate,
haskell-blaze-builder,
haskell-blaze-textual,
haskell-bloomfilter,
haskell-brainfuck,
haskell-hspec-discover,
haskell-pretty-show,
haskell-unlambda,
haskell-x509-util,
haskelldb-hdbc-odbc,
haskelldb-hdbc-postgresql,
haskelldb-hdbc-sqlite3,
hasktags,
hedgewars,
hscolour,
https-everywhere,
java-comment-preprocessor,
jffi,
jgit,
jnr-ffi,
jnr-netdb,
jsoup,
lhs2tex,
libcolor-calc-perl,
libfile-changenotify-perl,
libpdl-io-hdf5-perl,
libsvn-notify-mirror-perl,
localizer,
maven-enforcer,
pyotherside,
python-xlrd,
python-xstatic-angular-bootstrap,
rt-extension-calendar,
ruby-builder,
ruby-em-hiredis,
ruby-redcloth,
shellcheck,
sisu-plexus,
tomcat-maven-plugin,
v4l2loopback,
vim-latexsuite.
The following packages became reproducible after getting fixed:
modified-by option.__DATE__ and __TIME__ macros from source.debian/changelog entry in manpage.debian/changelog entry.HTML_TIMESTAMP to NO in Doxygen configuration.HTML_TIMESTAMP to NO in Doxygen configuration.HTML_TIMESTAMP set to NO.$datetime from the file api_footer.html.$datetime from the file footer.html.$PATH. The second build will be done with a /i/capture/the/path added. (Holger Levsen)
Holger Levsen with the help of Alexander Couzens wrote extra job to test the reproducibility of coreboot. Thanks James McCoy for helping with certificate issues.
Mattia Rizollo made some more internal improvements.
strip-nondeterminism development
Andrew Ayer released strip-nondeterminism/0.008-1. This new version fixes the gzip handler so that it now skip adding a predetermined timestamp when there was none.
Holger Levsen sponsored the upload.
Documentation update
The pages about timestamps in manpages generated by Doxygen, GHC .hi files, and Jar files have been updated to reflect their status in upstream.
Markus Koschany documented an easy way to prevent Doxygen to write timestamps in HTML output.
Package reviews
83 obsolete
reviews have
been removed, 71 added and 48 updated this week.
Meetings
A meeting was held on 2015-06-03. Minutes and full logs are available.
It was agreed to hold such a meeting every two weeks for the time being. The time of the next meeting should be announced soon.
What happened about the reproducible
builds effort for this week:
Toolchain fixes
contrib:
Thanks to the reproducible-build team for running a buildd from hell. gregor herrmannMattia Rizzolo modified the script added last week to reschedule a package from Alioth, a reason can now be optionally specified. Holger Levsen splitted the package sets page so each set now has its own page. He also added new sets for Java packages, Haskell packages, Ruby packages, debian-installer packages, Go packages, and OCaml packages. Reiner Herrmann added locales-all to the set of packages installed in the build environment as its needed to properly identify variations due to the current locale. Holger Levsen improved the scheduling so new uploads get tested sooner. He also changed the
.json output that is used by
tracker.debian.org to lists FTBFS issues again
but only for issues unrelated to the toolchain or our test setup. Amongst many
other small fixes and additions, the graph colors should now be
more friendly to red-colorblind people.
The fix for pbuilder given in
#677666 by Tim Landscheidt is now used. This
fixed several FTBFS for OCaml packages.
Work on rebuilding with different CPU has continued, a kvm-on-kvm build host
has been set been set up for this purpose.
debbindiff development
Version 19 of
debbindiff included a fix for a
regression when handling info files.
Version 20 fixes a bug when diffing
files with many differences toward a last line with no newlines. It also now
uses the proper encoding when writing the text output to a
pipe, and detects info files better.
Documentation update
Thanks to Santiago Vila, the unneeded -depth option used with find when
fixing mtimes has been removed from the examples.
Package reviews
113 obsolete
reviews have
been removed this week while 77 has been added.
Debian Jessie has been released on April 25th, 2015. This has opened the
Stretch development cycle. Reactions to the idea of making Debian
build reproducibly have
been pretty enthusiastic. As the pace is now likely to be even faster,
let's see if we can keep everyone up-to-date on the developments.
Before the release of Jessie
The story goes back a long
way
but a formal announcement to the
project
has only been sent in February 2015.
Since then, too much work has happened to make a complete report, but
to give some highlights:
unstable are tested but also those in testing
and experimental.--enable-deterministic-archives flag. Making ar, strip and
others create deterministic static
libraries.dh_makeshlibs
(#774100), dh_icons
(#774102), dh_usrlocal
(#775020). Patches written
by Lunar.--no-include-build-time option.
Patch by Jelmer
Vernooij.pidl
(from libparse-pidl-perl) reproducible.-creation-date to genisoimage.
Reiner Herrmann opened #783938 to
request making -notimestamp the default behavior for javadoc.
Juan Picca submitted a patch to add a
--use-date flag to texi2html.
Packages fixed
The following packages became reproducible due to changes of their
build dependencies:
apport,
batctl,
cil,
commons-math3,
devscripts,
disruptor,
ehcache,
ftphs,
gtk2hs-buildtools,
haskell-abstract-deque,
haskell-abstract-par,
haskell-acid-state,
haskell-adjunctions,
haskell-aeson,
haskell-aeson-pretty,
haskell-alut,
haskell-ansi-terminal,
haskell-async,
haskell-attoparsec,
haskell-augeas,
haskell-auto-update,
haskell-binary-conduit,
haskell-hscurses,
jsch,
ledgersmb,
libapache2-mod-auth-mellon,
libarchive-tar-wrapper-perl,
libbusiness-onlinepayment-payflowpro-perl,
libcapture-tiny-perl,
libchi-perl,
libcommons-codec-java,
libconfig-model-itself-perl,
libconfig-model-tester-perl,
libcpan-perl-releases-perl,
libcrypt-unixcrypt-perl,
libdatetime-timezone-perl,
libdbd-firebird-perl,
libdbix-class-resultset-recursiveupdate-perl,
libdbix-profile-perl,
libdevel-cover-perl,
libdevel-ptkdb-perl,
libfile-tail-perl,
libfinance-quote-perl,
libformat-human-bytes-perl,
libgtk2-perl,
libhibernate-validator-java,
libimage-exiftool-perl,
libjson-perl,
liblinux-prctl-perl,
liblog-any-perl,
libmail-imapclient-perl,
libmocked-perl,
libmodule-build-xsutil-perl,
libmodule-extractuse-perl,
libmodule-signature-perl,
libmoosex-simpleconfig-perl,
libmoox-handlesvia-perl,
libnet-frame-layer-ipv6-perl,
libnet-openssh-perl,
libnumber-format-perl,
libobject-id-perl,
libpackage-pkg-perl,
libpdf-fdf-simple-perl,
libpod-webserver-perl,
libpoe-component-pubsub-perl,
libregexp-grammars-perl,
libreply-perl,
libscalar-defer-perl,
libsereal-encoder-perl,
libspreadsheet-read-perl,
libspring-java,
libsql-abstract-more-perl,
libsvn-class-perl,
libtemplate-plugin-gravatar-perl,
libterm-progressbar-perl,
libterm-shellui-perl,
libtest-dir-perl,
libtest-log4perl-perl,
libtext-context-eitherside-perl,
libtime-warp-perl,
libtree-simple-perl,
libwww-shorten-simple-perl,
libwx-perl-processstream-perl,
libxml-filter-xslt-perl,
libxml-writer-string-perl,
libyaml-tiny-perl,
mupen64plus-core,
nmap,
openssl,
pkg-perl-tools,
quodlibet,
r-cran-rjags,
r-cran-rjson,
r-cran-sn,
r-cran-statmod,
ruby-nokogiri,
sezpoz,
skksearch,
slurm-llnl,
stellarium.
The following packages became reproducible after getting fixed:
-DNO_VERSION_DATE to build system.--use-date to texi2html.-creation-date to
genisoimage.debbindiff output, missing build logs, unavailable build
dependencies.
Holger Levsen added a new execution environment to run debbindiff using
dependencies from testing. This is required for packages built with
GHC as the compiler only understands interfaces built by the same
version.
debbindiff development
Version 17 has been uploaded to unstable. It now supports comparing
ISO9660 images, dictzip files and should compare identical files much
faster.
Documentation update
Various small updates and fixes to the pages about
PDF produced by LaTeX,
DVI produced by
LaTeX,
static
libraries,
Javadoc,
PE
binaries,
and Epydoc.
Package reviews
Known issues have been tagged when known to be deterministic as some
might unfortunately not show up on every single build.
For example, two new issues have been identified by building with one
timezone in April and one in May. RD
and help2man add current month and
year to the documentation they are producing.
1162 packages have been removed and 774 have been added in
the past week. Most of them are the work of proper automated
investigation done by Chris West.
Summer of code
Finally, we learned that both akira and Dhole were accepted for
this Google Summer of
Code.
Let's welcome them!
They have until May 25th before coding officialy begins. Now is the good time
to help them feel more comfortable by sharing all these little bits of
knowledge on how Debian works.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1,SHA512
I'm transitioning my GPG key from an old 1024D key to a new 4096R key.
The old key will continue to be valid for some time, but I prefer
all new correspondance to be encrypted to the new key, and will be making
all signatures going forward with the new key.
This transition document is signed with both keys to validate the transition.
If you have signed my old key, I would appreciate signatures on my new
key as well, provided that your signing policy permits that without
re-authenticating me.
Old key:
pub 1024D/0x5DD5685778D621B4 2000-03-07
Key fingerprint = 0F3C 34D1 E4A3 8FC6 435C 01BA 5DD5 6857 78D6 21B4
New key:
pub 4096R/0x1D661A372FED8F94 2013-12-30
Key fingerprint = 9A17 578F 8646 055C E19D E309 1D66 1A37 2FED 8F94
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlSwEaIACgkQXdVoV3jWIbQW5QCgoFHVU/D4fKSbvmGv3nNy3MAW
S2UAn075ztmxQ8Y9/22crbUug1sEjfh5iQIcBAEBCgAGBQJUsBGiAAoJEB1mGjcv
7Y+U9PgP/29jPvrNcdWsLI8YK9U6+JzS+TMXNyfp6CQXc8O/+zJwqvvxNpqY3rLM
5otRLIEJ2EVdiF8sCWTDGusS9NkMePzumR0AFAR0iltIkekO5O0HbHhK0sXJQv0s
EipDpFRO9k4/CBpJEy6Pkkxwd3ndtmwrL1/oKeVmM4E62PJd9ofMpQb/gMUsrA8u
F8xoOXY8Os82Rrd759PypSxNecjd6SYaVJTHgFbZ0QIMJkdKaufifzARdw+v5jwg
8Q11BhpYxvUSugZgiciKA6RjRK5bfRnT8VQPFd0zneilsIW13zz/jub9df/vtM5L
vY/6jHvXczYXSG8EGpHJQCD3KtQJPWZ0Nz9rAm4emEPmR2qav6KGARatYAm0RBqZ
Y81YUEuiWzGli6DH1m9SQe8bqM/J94vQAAX9VqUn2gz0Z0Ey25kVQE7NOGsbbGVS
vD/E74FSk1At9/RGpstrfEjsDKPRman2xk/oZe+08sRB22CJl40N4tZV9AkCJNom
HHGZKp+VEKaCEiLUIRjKTHt2HTThg39zmxl+OnoTSFYvloxrDJyi9SxZgCAmBhbD
7kLkaSDmdUj6CmoilGU+gd2zmQl2D+RHinYZBxOUf1vi1MDLWNcLIMgrz4mRXgzE
YKkG0newf9UbyJw42sXe2ukNQBIqBcL/DmAhG7V+r0RD7MQnMEYy
=09bN
-----END PGP SIGNATURE-----
The new key is available from keyservers, e.g. pgp.mit.edu or others.
In other news: Yes, I've not been blogging much recently, will try to do updates more often. In the mean time, you can also refer to my Twitter account for random stuff or the new sigrok Twitter account for sigrok-related posts.
kdb qt-gui. It is very important to note that the gui is in version 0.0.2, meaning it is an alpha project and shouldn t be considered stable yet! This GUI is a convenient tool that lets you mount, unmount, search, import and export configurations. We are very excited about this tool and we hope it makes Elektra more accessible to all users. Check out the screenshot below to see this new GUI in action:
A screenshot of the new qt-gui tool
wresolver which is a simpler version of the regular resolver which is compatible with Windows. Additionally, there is a new Java binding, so now Elektra is compatible with applications and plugins written in Java! On top of these features, a new hosts plugin and a new rename plugin have been written. The new hosts in conjunction with improvements to the ini plugin allows for multiple styles of comments (because some ini dialects allow ; and # to be used to differentiate comments) to be used and preserved in configuration files. Additionally, this new hosts plugin is compatible with and differentiates between ipv4 and ipv6 entries.
There have also been a huge number of under-the-hood improvements, changes, and fixes; there have been so many in-fact that I am going to list them:
regexstore was added.add_plugin function which allows plugin developers to more easily and consistently add plugins when building Elektra.kdb mount-openicckdb list-tools which lists the available kdb tools.- prefix such as DPLUGINS=ALL;-xmltool" which would exclude xmltool.
Next.