Reproducible builds folks: Reproducible Builds: Weekly report #121
Here's what happened in the Reproducible Builds effort between Sunday August 13 and Saturday August 19 2017:
Reproducible Builds finally mandated by Debian Policy
"Packages should build reproducibly" was merged into Debian
policy! The added text is as follows and
has been included into debian-policy 4.1.0.0:
Reproducibility --------------- Packages should build reproducibly, which for the purposes of this document [#]_ means that given - a version of a source package unpacked at a given path; - a set of versions of installed build dependencies; - a set of environment variable values; - a build architecture; and - a host architecture, repeatedly building the source package for the build architecture on any machine of the host architecture with those versions of the build dependencies installed and exactly those environment variable values set will produce bit-for-bit identical binary packages. It is recommended that packages produce bit-for-bit identical binaries even if most environment variables and build paths are varied. It is intended for this stricter standard to replace the above when it is easier for packages to meet it. .. [#] This is Debian's precisification of the reproducible-builds.org definition _.
- Holger Levsen wrote a blog post
briefly describing the background and implications of this. To quote him: "we are not 94% done yet, rather more like half done or so. We still need tools and processes to enable anyone to indepently verify that a given binary comes from the sources it is said to be coming, this will involve distributing
.buildinfofiles and providing user interfaces in APT and elsewhere and probably also systematic rebuilds by us and other parties. And 6% or 7% of the archive is still a lot of packages, eg. in Buster we currently still have 273 unreproducible key packages and for a large part we don't have patches yet so there is still a lot of work ahead." - There were discussion threads on Hacker News and Reddit.
- Our long-term goal is that Policy mandates that packages "must" be reproducible, but for that we need to show further progress and also reach a consensus on
.buildinfofiles and much more.
reproducible-check program to report on the reproducibility status of
installed packages.
Packages reviewed and fixed, and bugs filed
Upstream reports:
- Bernhard M. Wiedemann:
- qt5/base,
SOURCE_DATE_EPOCHsupport.
- qt5/base,
- Adrian Bunk:
- Chris Lamb:
- #872453 filed against isa-support.
- #872459 filed against python-numpy.
- #872460 filed against gcab, forwarded upstream.
- #872514 filed against devscripts.
- #872728 filed against desktop-file-utils.
- #872729 filed against gtk+2.0, forwarded upstream, found via a reproducibility issue in Tails.
- Federico Brega:
- Jeremy Bicha:
- Philip Rinn:
- Mattia Rizzolo:
- console-data (for bug #799871).
- Added nondeterministic_output_generated_by_gcab.
- Added build_path_captured_by_python_numpy_misc_util.
- Added captures_build_path_in_sphinx_attr_links.
- Re-added nondeterminstic_ordering_in_gsettings_glib_enums_xml.
- Adrian Bunk (59)
- Bastien Roucari s (1)
- James Clarke (1)
- Jeremy Bicha (1)
- Ximin Luo:
- Chris Lamb:
- Temporarily revert "Bump Standards-Version to 4.0.1" to avoid spurious CI test failures.
- comparators.xml: Use
nameattribute overpathto avoid leaking comparison full path in output. - Code style fixes.
- Chris Lamb:
- Add simple autopkgtest.
- Ximin Luo:
- Choose an existent
HOMEfor the "control" build. (Closes: #860428) - Update
debian/changelogwith Santiago's changes.
- Choose an existent
- Santiago Torres:
- Abstract parts of autopkgtest to support running on non-Debian systems.
- Add a
--host-distroflag to support that too.
The idea is simply to have one coherent place with pointers to all the stuff we have and provide, without repeating nor replacing other documentation.
What happened in the