Reproducible Builds: Weekly report #135

Here’s what happened in the Reproducible Builds effort between Sunday November 19 and Saturday November 25 2017:

Upcoming events

Reproducible Builds will have an assembly at 34c3, the “Galactic Congress”. ;-) Currently we are discussing to informally meet there every day at 13:37 UTC.

Reproducible Arch Linux

Since November 23 2017, Arch Linux is again being continuously tested for reproducibility. However, this time a patched pacman is being used which can create reproducible packages. After 4 days of testing, 18% of all packages in the core, extra, multilib and community Arch repos has been tested, with these — very preliminary — results:

• core: 77.1% reproducible, all 197 packages tested.
• extra: 75.2% reproducible, 514 packages (of 2250 total) tested.
• multilib: 82.6% reproducible, all 259 packages tested.
• community: 76.5% reproducible, 487 packages (of 7739 total) tested.

Jelle van der Waa also wrote a blog post explaining more details detailing how this already had lead to more QA work in Arch.

So all in all, it looks like 77.2% of the tested Arch Linux packages are now reproducible! With an unreleased pacman version and without some variations we apply when testing Debian… still this is a very good start! Kudos to all involved.

Packages reviewed and fixed, and bugs filed

Patches filed upstream:

• Bernhard M. Wiedemann:
  • libvma - date, SOURCE_DATE_EPOCH support
  • nfoview (merged) - file ordering, Python glob
  • systemtap - date
• Chris Lamb:
  • gpaw - (merged) embedded logging output
  • bitz-server (merged) - build path

Patches filed in Debian:

• Chris Lamb:
  • #882112 filed against bitz-server buildpath.
  • #882277 filed against atk1.0 buildpath.
  • #882383 filed against json-glib buildpath.
  • #882446 filed against geocode-glib buildpath.
  • #882447 filed against pyzor randomness.
  • #882462 filed against bugs-everywhere randomness.
  • #882578 filed against pymongo timestamps.
  • #882579 filed against landslide buildpath.
  • #882580 filed against ruby-mmap2 buildpath.
  • #882638 filed against gpaw timestamps.
  • #882639 filed against sfepy timestamps.
  • #882727 filed against libffi-platypus-perl randomness.

Patches filed in openSUSE:

• Bernhard M. Wiedemann:
  • cloud-init - randomness from python’s mkdtemp
  • kernel-obs-build - random filesystem UUID

Reviews of unreproducible packages

97 package reviews have been added, 56 have been updated and 42 have been removed in this week, adding to our knowledge about identified issues.

2 issue types have been added:

• timestamps_in_rcc_files_generated_by_rcc
• build_path_in_files_generated_by_qdbusxml2cpp

Weekly QA work

During our reproducibility testing, FTBFS bugs have been detected and reported by:

• Adrian Bunk (62)
• Gilles Filippini (1)
• Gregor Riepl (1)
• James Cowgill (1)
• Laurent Bigonville (1)
• Matthias Klose (1)
• Sylvestre Ledru (2)
• gregor herrmann (1)

reproducible-faketools

• reproducible-faketools 0.3.10 was released with support for:
  • Reduced randomness (/dev/random and urandom are actually /dev/zero)
  • Disabled ASLR and
  • Building with fixed PIDs.
  • Also the tar wrapper script got a bug fix.

reprotest development

• Ximin Luo:
  • build: comment about why we do ‘sudo -h localhost’
  • build: add num_cpu variation
  • build: add aslr variation
  • build: just use “sudo -h localhost” instead of messing around with mount namespaces

reproducible-website development

• Chris Lamb:
  • Add a (redirecting) /docs/source-date-epoch/ page so we have a canonical URL on r-b.org.
  • Add a ‘blank’ Jekyll layout.
• Holger Levsen:
  • Add Qubes OS to the list of involved projects - thanks to Andew David Wong

tests.reproducible-builds.org

• anthraxx worked on reproducible Arch Linux (19 commits)
• Holger Levsen did some work on reproducible Debian:
  • aa9ce22d6 - Update email subject of status change mails to use t.r-b.o/debian - thanks to lamby for #882186
• Holger mostly worked on reproducible Arch Linux that week (56 commits).
• Misc tests.r-b.o work by Holger:
  • 0d79ab54a - reproducible Fedora: be explicit that this is stalled atm
  • Holger also reviewed and deployed 25 commits from other people.
  • Finally, Holger moved IRC notifications for jenkins.debian.net from #debian-reproducible to #reproducible-builds (and kept them on #debian-qa as well).
• Johannes Löthberg worked on Arch Linux as well (2 commits)
• kpcyrd also worked on Arch Linux (5 commits)

Finally there was discussion to how to generalise the database schema for supporting several projects, triggered by the recent work on reproducible Arch, but also previously discussed in the context of openSUSE, LEDE and FreeBSD.

Misc.

This week’s edition was written by Ximin Luo, Bernhard M. Wiedemann, Holger Levsen and Chris Lamb & reviewed by a bunch of Reproducible Builds folks on IRC & the mailing lists.