← View all weekly reports

Reproducible Builds: Weekly report #11

Published: Jul 13, 2015.

Debian is undertaking a huge effort to develop a reproducible builds system. I’d like to thank you for that. This could be Debian’s most important project, with how badly computer security has been going.

— PerniciousPunk in Reddit’s Ask me anything! to Neil McGovern, DPL.

What happened in the reproducible builds effort this week:

Toolchain fixes

More tools are getting patched to use the value of the SOURCE_DATE_EPOCH environment variable as the current time:

In the “reproducible” experimental toolchain which have been uploaded:

Johannes Schauer followed up on making sbuild build path deterministic with several ideas.

Packages fixed

The following 311 packages became reproducible due to changes in their build dependencies : 4ti2, alot, angband, appstream- glib, argvalidate, armada- backlight, ascii, ask, astroquery, atheist, aubio, autorevision, awesome- extra, bibtool, boot-info- script, bpython, brian, btrfs- tools, bugs- everywhere, capnproto, cbm, ccfits, cddlib, cflow, cfourcc, cgit, chaussette, checkbox- ng, cinnamon-settings- daemon, clfswm, clipper, compton, cppcheck, crmsh, cupt, cutechess, d-itg, dahdi- tools, dapl, darnwdl, dbusada, debian-security- support, debomatic, dime, dipy, dnsruby, doctrine, drmips, dsc- statistics, dune- common, dune- istl, dune- localfunctions, easytag, ent, epr- api, esajpip, eyed3, fastjet, fatresize, fflas- ffpack, flann, flex, flint, fltk1.3, fonts- dustin, fonts- play, fonts- uralic, freecontact, freedoom, gap- guava, gap- scscp, genometools, geogebra, git- reintegrate, git-remote- bzr, git-remote- hg, gitmagic, givaro, gnash, gocr, gorm.app, gprbuild, grapefruit, greed, gtkspellmm, gummiboot, gyp, heat- cfntools, herold, htp, httpfs2, i3status, imagetooth, imapcopy, imaprowl, irker, jansson, jmapviewer, jsdoc- toolkit, jwm, katarakt, khronos-opencl- man, khronos-opengl- man4, lastpass- cli, lava- coordinator, lava- tool, lavapdu, letterize, lhapdf, libam7xxx, libburn, libccrtp, libclaw, libcommoncpp2, libdaemon, libdbusmenu- qt, libdc0, libevhtp, libexosip2, libfreenect, libgwenhywfar, libhmsbeagle, libitpp, libldm, libmodbus, libmtp, libmwaw, libnfo, libpam- abl, libphysfs, libplayer, libqb, libsecret, libserial, libsidplayfp, libtime-y2038-perl, libxr, lift, linbox, linthesia, livestreamer, lizardfs, lmdb, log4c, logbook, lrslib, lvtk, m-tx, mailman- api, matroxset, miniupnpd, mknbi, monkeysign, mpi4py, mpmath, mpqc, mpris- remote, musicbrainzngs, network- manager, nifticlib, obfsproxy, ogre-1.9, opal, openchange, opensc, packaging- tutorial, padevchooser, pajeng, paprefs, pavumeter, pcl, pdmenu, pepper, perroquet, pgrouting, pixz, pngcheck, po4a, powerline, probabel, profitbricks- client, prosody, pstreams, pyacidobasic, pyepr, pymilter, pytest, python- amqp, python- apt, python- carrot, python- django, python- ethtool, python- mock, python- odf, python- pathtools, python- pskc, python- psutil, python- pypump, python- repoze.tm2, python- repoze.what, qdjango, qpid- proton, qsapecng, radare2, reclass, repsnapper, resource- agents, rgain, rttool, ruby- aggregate, ruby- albino, ruby-archive-tar- minitar, ruby- bcat, ruby- blankslate, ruby-coffee- script, ruby- colored, ruby-dbd- mysql, ruby-dbd- odbc, ruby-dbd- pg, ruby-dbd- sqlite3, ruby- dbi, ruby-dirty- memoize, ruby- encryptor, ruby- erubis, ruby-fast- xs, ruby- fusefs, ruby- gd, ruby- git, ruby- globalhotkeys, ruby- god, ruby- hike, ruby- hmac, ruby- integration, ruby-jnunemaker- matchy, ruby- memoize, ruby-merb- core, ruby-merb- haml, ruby-merb- helpers, ruby- metaid, ruby- mina, ruby-net- irc, ruby-net- netrc, ruby- odbc, ruby- ole, ruby- packet, ruby- parseconfig, ruby- platform, ruby- plist, ruby- popen4, ruby- rchardet, ruby- romkan, ruby- ronn, ruby- rubyforge, ruby- rubytorrent, ruby- samuel, ruby-shoulda- matchers, ruby- sourcify, ruby-test- spec, ruby- validatable, ruby- wirble, ruby-xml- simple, ruby- zoom, rumor, rurple- ng, ryu, sam2p, scikit- learn, serd, shellex, shorewall- doc, shunit2, simbody, simplejson, smcroute, soqt, sord, spacezero, spamassassin- heatu, spamprobe, sphinxcontrib- youtube, splitpatch, sratom, stompserver, syncevolution, tgt, ticgit, tinyproxy, tor, tox, transmissionrpc, tweeper, udpcast, units- filter, viennacl, visp, vite, vmfs- tools, waffle, waitress, wavtool- pl, webkit2pdf, wfmath, wit, wreport, x11proto- input, xbae, xdg- utils, xdotool, xsystem35, yapsy, yaz.

Please note that some packages in the above list are falsely reproducible. In the experimental toolchain, debhelper exported TZ=UTC and this made packages capturing the current date (without the time) reproducible in the current test environment.

The following packages became reproducible after getting fixed:

Ben Hutchings upstreamed several patches to fix Linux reproducibility issues which were quickly merged.

Some uploads fixed some reproducibility issues but not all of them:

Uploads that should fix packages not in main :

  • fglrx-driver/1:15.7-1 uploaded by Patrick Matthäi, fixed by Andreas Beckmann.
  • pycuda/2015.1.2-1 uploaded by Tomasz Rybak, patch by Juan Picca.

Patches submitted which have not made their way to the archive yet:

  • #787675 on ricochet by Daniel Kahn Gillmor: use the debian/changelog date in the manpage.
  • #791648 on fish by Chris Lamb: sort header files in documentation.
  • #791691 on fritzing by Chris Lamb: sort the documentation author list using the C locale.
  • #791834 on bitcoin by Reiner Herrmann: sort sources files using the C locale.
  • #791845 on yacas by Reiner Herrmann: sort hints using the C locale.
  • #791851 on scowl by Reiner Herrmann: sort dictionary files using the C locale.
  • #791913 on ceph by Chris Lamb: sort configuration file names.
  • #791923 on alpine by Chris Lamb: use debian/changelog date as build date and use debian as the builder hostname.
  • #791960 on leveldb by Reiner Herrmann: sort sources files using th e C locale.
  • #792054 on ben by Reiner Herrmann: use debian/changelog date as bui ld date.
  • #792056 on val-and-rick by Reiner Herrmann: sort sources by filenames.

reproducible.debian.net

A new package set has been added for lua maintainers. (h01ger)

tracker.debian.org now only shows reproducibility issues for unstable.

Holger and Mattia worked on several bugfixes and enhancements: finished initial test setup for NetBSD, rewriting more shell scripts in Python, saving UDD requests, and more…

debbindiff development

Reiner Herrmann fixed text comparison of files with different encoding.

Documentation update

Juan Picca added to the commands needed for a local test chroot installation of the locales-all package.

Package reviews

286 obsolete reviews have been removed, 278 added and 243 updated this week.

43 new bugs for packages failing to build from sources have been filled by Chris West (Faux), Mattia Rizzolo, and h01ger.

The following new issues have been added: timestamps_in_manpages_generated_by_ronn, timestamps_in_documentation_generated_by_org_mode, and timestamps_in_pdf_generated_by_matplotlib.

Misc.

Reiner Herrmann has submitted patches for OpenWrt.

Chris Lamb cleaned up some code and removed cruft in the misc.git repository. Mattia Rizzolo updated the prebuilder script to match what is currently done on reproducible.debian.net.

← View all weekly reports