Reproducible Builds: Weekly report #161

Here’s what happened in the Reproducible Builds effort between Sunday May 20 and Saturday May 26 2018:

• On Sunday 20th May Chris Lamb, Holger Levsen, Jonathan Bustillos Osornio (jathan) and Steven Chamberlain presented on Reproducible Builds at the MiniDebConfHamburg, focusing on the status in Debian buster. Slides and links to videos are available on our Resources page.

• Holger then followed-up with a blog post entitled “Debian is wrong”, a selection of which was chosen as “Distribution Quote of the Week” on Linux Weekly News (LWN).

• Arnout Engelen concluded voting for our new logo & typeface resulting in a winner (shown above).

• Antoine Beaupré was published on LWN with an article that touches on reproducible builds, entitled Securing the container image supply chain.

• Mes, a Scheme-based compiler for our “sister” bootstrappable builds effort, announced their 0.14 release. It now compiles a self-hosting TinyCC that has only been slightly patched. This means that Mes can now build a tcc that depends only on a 1MB ASCII M1 seed, compared to GuixSD currently uses a ~250MB binary seed to build gcc.

• Chris Lamb updated our reproducible-builds.org/ website to add a favicon and to drop a trailing forward-slash from the <link rel="vcs-git" />header attribute.

• 18 package reviews have been added, 45 have been updated and 41 have been removed in this week, adding to our knowledge about identified issues.

Packages reviewed and fixed, and bugs filed

• Bernhard M. Wiedemann:
  • parted (sort readdir(2),via version update)
  • openclonk (date)
  • photoqt (random)
  • python-datrie (sort readdir(2))
  • python-pycryptopp (filed upstream)
  • pip install random path
  • gap-ace (use changelog date)
  • restkit (date)
  • numpy (sort readdir(2))
  • sunpy (sort readdir(2))
  • lilypond (random)
  • icu (FTBFS-2030)
• Chris Lamb:
  • #899162 filed against vitrage.
  • #899358 filed against weston.

diffoscope development

Version 95 was uploaded to unstable by Mattia Rizzolo. It includes contributions already covered by posts in previous weeks as well as new ones from:

• Chris Lamb:

  • Change the “No file format specific differences found inside, yet data differs” message to be clearer that diffoscope “knows” about this file format yet could not be helpful in this case.
  • Various PEP8 style fixes, including: E731, E502, E501, E302, E251, E241, E226, PEP8: E121, E122, E126, E128, etc.
  • Don’t append rather useless “(data)” suffix.

• Mattia Rizzolo:

  • Fix an misnamed filename reference in the PDF tests.

tests.reproducible-builds.org development

There were a number of changes to our Jenkins-based testing framework, including:

• Holger Levsen:

  • Don’t (additionally) compress Packages.gz.

• Mattia Rizzolo:

  • Access our experimental repository over HTTP (vs. HTTPS), to permit caching.
  • Do not force-redirect /debian/repository/debian to HTTPS to allow caching.
  • Change into working directory before calling git pull.

• As part of the ongoing maintenance work:

  • Holger rebooted the arm64 nodes that form part of our testing framework and also removed old kernels to prevent /boot from filling up.

  • Chris Lamb updated the SSL certificate for buildinfo.debian.net.

Misc.

This week’s edition was written by Arnout Engelen, Bernhard M. Wiedemann, Chris Lamb, Holger Levsen and Vagrant Cascadian & reviewed by a bunch of Reproducible Builds folks on IRC & the mailing lists.