Reproducible Builds: Weekly report #134

Here’s what happened in the Reproducible Builds effort between Sunday November 12 and Saturday November 18 2017:

Past and upcoming events

We plan to hold an assembly at 34C3 - hope to see you there!

On November 17th Chris Lamb presented at the Open Compliance Summit in Yokohama, Japan on how reproducible builds can ensure the long-term sustainability of technology infrastructure.

GSoC and Outreachy updates

We are pleased to announce that Juliana Oliveira R (jwnx) will be mentored by Mattia Rizzolo on Reproducible Builds / diffoscope in this round of Outreachy!

Reproducible work in other projects

• Tails announced that they were proud to present Tails 3.3 as one of the “world’s first reproducible ISO images”.

• Support for SOURCE_DATE_EPOCH in the \pdftrailerid command of TeX Live was merged.

• Pierre Pronchery (khorben) submitted a patch to build pkgsrc packages reproducibly.

• The Google Container Tools team announced the release of container-diff, a new project to help uncover differences between container images.

Bootstrapping and Diverse Double Compilation

Work on bootstrapping also made progress in MesCC from Jan Nieuwenhuizen. MesCC now compiles a less heavily patched TinyCC into a mes-tcc which passes 41/69 of mescc’s C tests.

Qt tests and __FILE__

Our patched GCC that we use for testing Debian unstable has uncovered an interesting issue with certain Qt build-time test suites. The issue is that test suites using QFINDTESTDATA depend on __FILE__ to expand to something that may be reused after compilation as a real filesystem path when starting from the same working directory as the original compilation.

However, this behaviour is not explicitly guaranteed by formal documentation about __FILE__, and thus when it is rewritten to be build-path-independent (by a combination of our patched dpkg and GCC), the Qt tests break because their usage is no longer expanded to a real path as they expected.

Several very short patches were suggested to resolve this issue, including a one-liner that allows our patched GCC to specifically rewrite __FILE__ in Qt test code to a real path which takes advantage of the ability to specify multiple mappings using BUILD_PATH_PREFIX_MAP.

Separately, work is under way to address the other unrelated concerns raised about the patch by GCC upstream back in August.

Packages reviewed and fixed, and bugs filed

• Adrian Bunk:
  • #881453 filed against primesieve.
  • #881804 filed against ruby2.3.
  • #881865 filed against libctapimkt.
  • #881915 filed against libidn2.
  • #882002 filed against gpaste.
• Chris Lamb:
  • #881474 filed against phatch (ASLR randomness in pointer).
  • #881788 filed against opusfile (buildpath).
  • #881872 filed against ardour (hash randomness).
  • #881905 filed against py3c (buildpath).
  • #882112 filed against bitz-server (buildpath).
• Christoph Biedl:
  • #881627 filed against ruby-http-parser.rb.
• Danny Lee:
  • #881664 filed against chessx (cpu?, hostname?, QT/rcc).
  • #881666 filed against kmag (cpu?).
• Matthias Klose:
  • #881793 filed against daisy-player.
  • #881794 filed against gmerlin.
  • #881797 filed against xmms2.
• Bernhard M. Wiedemann:
  • coccinelle (date)
  • opa-ff (date)
  • gambas (merged, filesystem/readdir order)

Reviews of unreproducible packages

35 package reviews have been added, 56 have been updated and 31 have been removed in this week, adding to our knowledge about identified issues.

1 issue type has been updated:

• random_contents_in_dat_files_generated_by_chasen-dictutils_makemat (bwiedemann)

tests.reproducible-builds.org

• Ed Maste (FreeBSD support):
  • Give ntpd a moment to write its PID file.
  • Start with the correct time.
• kpcyrd (Archlinux support):
  • Pass SOURCE_DATE_EPOCH from jenkins_node_wrapper.sh.
  • Set SOURCE_DATE_EPOCH.
  • Use $ROOTCMD properly.
  • Set pkgext to .pkg.tar.xz.
  • Fix lost packages.
  • Correctly recognize __END__.
  • pacman.conf is owned by root after upgrade.
  • Add repos to pacman.conf.
• Holger Levsen:
  • Arch Linux:
    • Re-enable the builders.
    • Add a third builder job to use new resources.
  • FreeBSD:
    • Ignore freebsd_master_git?????????.tar.xz when looking for unreproducible artifacts.
    • Document that munin-node was finally configured (and how denyhosts was configured too).
    • Our test VM has been upgraded to 11.1.
    • Document that poudriere was installed, user mattia created and filesystem resized.
  • Debian: Update documentation to reflect that the database is now kept in PostgreSQL.
  • Redistribute 13 cores and 24GB RAM from pb17 to pb3 and pb4 (used to build LEDE, Arch & coreboot) and the FreeBSD VM.

Weekly QA work

During our reproducibility testing, FTBFS bugs have been detected and reported by:

• Adam Borowski (1)
• Adrian Bunk (30)
• Andreas Beckmann (2)
• Christoph Biedl (1)
• Helmut Grohne (2)
• James Cowgill (1)
• Matthias Klose (4)

reproducible-website development

• Chris Lamb:
  • Update some broken links and references on the contribute” page (1, 2, 3)
  • Add a missing “)” Thanks to itd for the patch!

Misc.

This week’s edition was written by Chris Lamb, Holger Levsen and Ximin Luo & reviewed by a bunch of Reproducible Builds folks on IRC & the mailing lists.