What happened in the reproducible builds effort this week: Toolchain fixes

• Barry Warsaw uploaded wheel/0.26.0-1 which now uses SOURCE_DATE_EPOCH instead of WHEEL_FORCE_TIMESTAMP and uses time.gmtime() to avoid timezone issues. Patches by Chris Lamb and Reiner Herrmann.

Andreas Metzler uploaded autogen/1:5.18.6-1 in experimental with several patches for reproducibility issues written by Valentin Lorentz. Groovy upstream has merged a change proposed by Emmanuel Bourg to remove timestamps generated by groovydoc. Ben Hutchings submitted a patch to add support for SOURCE_DATE_EPOCH in linux-kbuild as an alternate way to specify the build timestamp. Reiner Herrman has sent a patch adding support for SOURCE_DATE_EPOCH in docbook-utils. Packages fixed The following packages became reproducible due to changes in their build dependencies: commons-csv. fest-reflect, sunxi-tools, xfce4-terminal, The following packages became reproducible after getting fixed:

• httpcomponents-client/4.5.1-1 by Emmanuel Bourg.
• jhead/1:3.00-2 by Ludovic Rousseau.
• libvigraimpex/1.10.0+dfsg-10 by Daniel Stender.
• linux/4.2-1~exp1 by Ben Hutchings.
• maelstrom/1.4.3-L3.0.6+main-7 by Santiago Vila.
• nedit/1:5.6a-3 by Paul Gevers.
• pitivi/0.94-4 by Sebastian Dr ge, reported by Scott Kitterman.
• procenv/0.40-2 by James Hunt.
• seyon/2.20c-32 by Santiago Vila.
• slib/3b1-5 by Santiago Vila.
• spock/0.7-groovy-2.0-1 by Emmanuel Bourg.
• u-boot/2015.10~rc4+dfsg1-1 by Vagrant Cascadian.
• vdr-plugin-remote/0.7.0-1 by Tobias Grimm.

Some uploads fixed some reproducibility issues but not all of them:

• dutch/1:2.10-4 uploaded by Thijs Kinkhorst, original patch by Chris Lamb.

Patches submitted which have not made their way to the archive yet:

• #800776 on cluster-glue: exports SOURCE_DATE_EPOCH in debian/rules.

Tomasz Rybak uploaded pycuda/2015.1.3-1 which should fix reproducibility issues. The package has not been tested as it is in contrib. akira found an embedded code copy of texi2html in fftw. reproducible.debian.net Email notifications are now only sent once a day per package, instead of on each status change. (h01ger) disorderfs has been temporarily disabled to see if it had any impact on the disk space issues. (h01ger) When running out of disk space, build nodes will now automatically detect the problem. This means test results will not be recorded as FTBFS and the problem will be reported to Jenkins maintainers. (h01ger) The navigation menu of package pages has been improved. (h01ger) The two amd64 builders now use two different kernel versions: 3.16 from stable and 4.1 from backports on the other. (h01ger) We now graph the number of packages which needs to be fixed. (h01ger) Munin now creates graphs on how many builds were performed by build nodes (example). (h01ger) A migration plan has been agreed with DSA on how to turn Jenkins into an official Debian service. A backport of jenkins-job-builder for Jessie is currently missing. (h01ger) Package reviews 119 reviews have been removed, 103 added and 45 updated this week. 16 fail to build from source issues were reported by Chris Lamb and Mattia Rizzolo. New issue this week: timestamps_in_manpages_generated_by_docbook_utils. Misc. Allan McRae has submitted a patch to make ArchLinux pacman record a .BUILDINFO file.

I am now back home after 2 days spent at the first mini DebConf Paris. It was really nice to meet a lot of people, and to be able to discuss various aspects of Debian and Free Software in general. People came from all over Europe (at least from the UK, Spain, Italy, Germany, Switzerland, Austria, Greece, and obviously a majority of French people). All the talks I have been able to attend were really interesting, and some of the slides have already been made available by their author:

• Debian and Ubuntu by Lucas Nussbaum
• Debian Quality Assurance by Lucas Nussbaum
• Latest features of dpkg-dev by Rapha l Hertzog
• Smart cards in Debian by Ludovic Rousseau

I have also taken part to the keysigning party, which will now allows me to use my newly generated 4096R key. The group picture is also online, as well as a more comprehensive gallery. Thanks a lot to the organisation team, you guys have made an awesome work! See you all next year!

mbeventd 0.6 is out, featuring support for the MacBook. Thanks go to Ryan Lortie for his macbook-backlight tool, providing the backlight control routines for the Intel GMA950, and to Enrico Tassi for bringing this to my intention with his ITP (#402193) and testing the new version. Thanks to Ludovic Rousseau who confirmed that mbpeventd was working on the Core Duo MacBook Pro. Additionally, mbpeventd should now detect all versions of the Mac Intel laptops. If it doesn’t, please drop me a mail and the output of mbpeventd -f run as root. I’m still not sure that the SMBIOS detection will work when using an EFI-aware kernel. Note: for the Core2 Duo machines, you need to use a kernel >= 2.6.19 for the function keys to work. Version 0.6 AMD64 packages and sources: http://people.debian.org/~jblache/pkg/mbpeventd/ Still no sound support, it’s the next item on the TODO list. It’s going to be a bit tricky, and I’m not yet sure how that should work (wrt the fact that the laptops use 2 different outputs for the headphones and speakers).

So finally I got my card reader running on Linux. It was not that hard, but the main problem was caused by the proprietary Linux driver I installed. Thanks to Ludovic Rousseau's Generic CCID driver the reader is able to run just fine with only Free Software. It works even with libchipcard2, but a tiny fix to udev was necessary to fix a permission problem (you might need to adapt the vendor and product id to your local card reader, as shown by lsusb):

/etc/udev/rules.d/smart_card.rules:
BUS=="usb", SYSFS idVendor =="04e6", SYSFS idProduct =="5116", GROUP="chipcard", MODE="0664"

With this tiny fix chipcardd2 correctly opens the card as a non-privileged user. My thanks also go to Thomas Viehmann, who provides an HBCI branch of Gnucash on Alioth. Apart from the application crashing a bit too often, the HBCI part works fine with my card and PIN. The only problem left is the sudden disconnect of the reader when it's not used for a few minutes. Only a restart of chipcardd2 and gnucash resolves the problem temporarily. All my homebanking activities are now properly signed, and the retrieval of transactions works just fine. To credit my bank a bit, I am a customer of 1822direkt, a subsidiary of the Frankfurter Sparkasse, since a few weeks. They provided me with a free checking account, together with a free(!) HBCI card. Transactions are mailed just-in-time (checked for hourly during working hours) PGP-encrypted. (Yes, they are running PGP5i on OS/2. I needed to create a RSA key using PHP5i/Unix without a passphrase. The public key output of PGP5i had to be sent to the bank, and after an import of the resulting public and private key into my GPG instance I was able to read the statements correctly. The mail interface did not cope with GPG-generated keys.)