Reproducible builds folks: Reproducible builds: week 59 in Stretch cycle
What happened in the Reproducible
Builds effort between June 5th and June 11th 2016:
Media coverage
Ed Maste gave a talk at BSDCan 2016 on
reproducible builds
(slides,
video).
GSoC and Outreachy updates
Weekly reports by our participants:
- Scarlett Clark worked on making some packages reproducible, focusing on KDE backend and utility programs.
- Ceridwen
published an initial design for the interface for
reprotest
, including a discussion on different types of build variations and the difficulties of specifying certain types of variations. - Valerie Young improved documentation for building our tests website, began migrating Debian-specific pages into a new namespace, and planned future work around its navigation.
SOURCE_DATE_EPOCH
spec explaining FORCE_SOURCE_DATE
.
Some upstream build tools (e.g. TeX, see below) have expressed a desire to
control which cases of embedded timestamps should obey SOURCE_DATE_EPOCH
.
They were not convinced by our arguments on why this is a bad idea, so we
agreed on an environment variable FORCE_SOURCE_DATE
for them to implement
their desired behaviour - named generically, so that at least we can set it
centrally. For more details, see the text just linked. However, we strongly
urge most build tools not to use this, and instead obey SOURCE_DATE_EPOCH
unconditionally in all cases.
Toolchain fixes
- TeX Live 2016 released
with
SOURCE_DATE_EPOCH
support for all engines except LuaTeX and original TeX. - Continued discussion
(alternative archive)
with TeX upstream, about
SOURCE_DATE_EPOCH
corner cases, eventually resulting in theFORCE_SOURCE_DATE
proposal from above. - gcc-5/5.4.0-4 by Matthias Klose now avoids storing
-fdebug-prefix-map
inDW_AT_producer
, thanks to original patch by Daniel Kahn Gillmor. - sphinx/1.4.3-1 by Dmitry Shachnev now drops Debian-specific patches
relating to
SOURCE_DATE_EPOCH
applied upstream, original patch by Alexis Bienven e. - asciidoctor/1.5.4-2 by C dric Boutillier now supports
SOURCE_DATE_EPOCH
, thanks to original patch by Alexis Bienven e. - dh-python/1.5.4-2 by Piotr O arowski now behaves better in some cases, thanks to original patch by Chris Lamb.
- excellent-bifurcation/0.0.20071015-8 by Vincent Cheng, original patch by Reiner Herrmann.
- gnurobbo/0.68+dfsg-2 by Stephen Kitt, original patch by Reiner Herrmann.
- gdbm/1.8.3-14 by Matthias Klose, original patch by J r my Bobbio.
- miceamaze/4.2.1-3 by Sarah COUDERT, original patch by Reiner Herrmann.
- netcdf/1:4.4.1~rc2-1~exp3 by Bas Couwenberg.
- osmo-bts/0.4.0-2 by Ruben Undheim.
- pd-hcs/0.1-3 by IOhannes m zm lnig.
- pd-hid/0.7-2 by IOhannes m zm lnig.
- python-certbot/0.8.0-1 by Harlan Lieberman-Berg, original patch by Chris Lamb.
- python-csb/1.2.3+dfsg-3 by Sascha Steinbiss.
- python-osprofiler/1.3.0-2 by Thomas Goirand.
- usb-modeswitch-data/20160112-3 by Didier Raboud, original patch by intrigeri.
- bzr/2.7.0-7 by Jelmer Vernoo .
- clanlib/1.0~svn3827-5 by Stephen Kitt, original patch by Chris Lamb.
- dwarfutils/20160507+git20160523.9086738-1 by Fabian Wolff.
- fakeroot/1.20.2-2 by Clint Adams, original patch.
- fastqtl/2.184+dfsg-2 by Dylan A ssi, original patch by Chris Lamb.
- gnuplot/5.0.3+dfsg3-3 by Anton Gladky.
- lazarus/1.6+dfsg-3 by Paul Gevers.
- python-pygit2/0.24.0-3 by Ond ej Nov .
- #806331 against xz-utils by Ximin Luo: make the selected POSIX shell stable accross build environments
- #806494 against gnupg by intrigeri: Make man pages not embed a build-time dependent timestamp
- #806945 against bash by Reiner Herrmann and Ximin Luo: Use the system man2html, and set PGRP_PIPE unconditionally.
- #825857 against python-setuptools by Anton Gladky: sort libs in native_libs.txt
- #826408 against brainparty by Reiner Herrmann: Sort object files for deterministic linking order
- #826416 against blockout2 by Reiner Herrmann: Sort the list of source files
- #826418 against xgalaga++ by Reiner Herrmann: Sort source files to get a deterministic linking order
- #826423 against kraptor by Reiner Herrmann: Sort source files for deterministic linking order
- #826431 against traceroute by Reiner Herrmann: Sort lists of libraries/source/object files
- #826544 against doc-debian by intrigeri: make the created files stable regardless of the locale
- #826676 against python-openstackclient by Chris Lamb: make the build reproducible
- #826677 against cadencii by Chris Lamb: make the build reproducible
- #826760 against dctrl-tools by Reiner Herrmann: Sort object files for deterministic linking order
- #826951 against slicot by Alexis Bienven e: please make the build reproducible (fileordering)
- #826982 against hoichess by Reiner Herrmann: Sort object files for deterministic linking order
- cryptographic_signature
- timestamps_in_maven_version_files
- ftbfs_build-indep_not_build_on_some_archs
- timestamps_added_by_xbean_spring
- timestamps_in_maven_metadata_local_xml_files
- timestamps_in_documentation_generated_by_asciidoctor
- Mattia Rizzolo uploaded diffoscope/54 to jessie-backports.
- Mattia uploaded strip-nondeterminism/0.018-1 to jessie-backports, to support a debhelper backport.
- Andrew Ayer uploaded strip-nondeterminism/0.018-2 fixing #826700, a packaging improvement for Multi-Arch to ease cross-build situations.
- 2 days later Andrew released strip-nondeterminism/0.019; now
strip-nondeterminism is able to:
- recursively normalize JAR files embedded within JAR files (#823917)
- clamp the timestamp, the same way tar >=1.28-2.2 can (for now available only for gzip archives)
- Andrew Ayer released disorderfs/0.4.3, fixing a issue with umask handling (#826891)
- Valerie Young namespaced the Debian-specific pages to /debian/ namespace, with redirects to for the previous URLs.
- Holger Levsen improved the reliability of build jobs: the availability of both build nodes (for a given build) is now being tested when a build job is started, to better cope when one of the 25 build nodes go down for some reason.
- Ximin Luo improved the index of identified issues to include the total popcon scores of each issue, which is now also used for sorting that page.