Reproducible Builds: Weekly report #178

Here’s what happened in the Reproducible Builds effort between Sunday September 16 and Saturday September 22 2018:

• A reminder that the fourth Reproducible Builds summit will take place from December 11th—13th 2018 at Mozilla in Paris, France. If you are interested in attending please register by sending an email to holger@layer-acht.org. More details may be found on the associated event page.

• Bernhard M. Wiedemannup updated disorderfs (our FUSE-based filesystem that deliberately introduces non-determinism into filesystem metadata) to use sys/xattr.h from glibc as newer libattr versions have dropped their own xattr.h header.

• Jelle van der Waa removed the SVN propset identifiers from the Arch Linux repository. This will make reproducing packages possible when the PKGBUILD is obtained from Git; previously the BUILDINFO would differ due to Git lacking the aforementioned identifier.

• Daniel Shahaf started an interesting discussion on our mailing list regarding reproducing tarballs under various toolchains. As a result, Daniel actually uncovered an argument parsing bug in libarchive. Volunteers are welcome to assist with documenting the GNU tar / BSD tar interoperability concerns that arose from this.

• An issue was opened in the CPython bug tracker regarding test failures regarding the SOURCE_DATE_EPOCH environment variable which actually proposes to revert the previous changes.

• Janneke published a blog post entitled “Reduced Binary Seed Bootstrap” in which they describe how the GuixSD operating system is working on a small subset of packages in order to achieve a truly-auditable “bootstrappable” package set.

• Chris Lamb reviewed 15 Debian packages, adding to our knowledge about identified issues. In addition, two issue types were updated: fixed_timestamp_in_fonts_generated_by_ufo2ft was removed and randomless_in_pdf2htmlex_html_output was renamed to randomness_in_pdf2htmlex_html_output.

• openSUSE’s wiki page on their approach and resources regarding reproducible builds was linked on our IRC channel.

• Holger Levsen switched back to recent i386 kernels on all i386 build nodes and rescheduled all currently-failing KDE packages which can be seen on the KDE package set page.

• Chris Lamb also updated the SSL certificate for buildinfo.debian.net.

Patches filed

• Bernhard M. Wiedemann:

  • libqt5-qtbase (toolchain, override mtime with SOURCE_DATE_EPOCH)
  • disorderfs (fix build)
  • pitivi (parallelism race)
  • sigil (fixup bad reproducibility patch)
  • kubernetes-dashboard (fix date + build from source)
  • dateutils (fix FTBFS-2018-10-07 via upstream patch)
  • python-execnet (extended fix for FTBFS-j1)
  • yubikey-manager-qt (merged, sort readdir(2))

• Chris Lamb:

  • #909078 filed against fltk1.1 in Debian.

diffoscope development

diffoscope version 102 was uploaded to Debian unstable by Mattia Rizzolo. It included contributions already covered in previous weeks as well as new ones from:

• Chris Lamb:
  • Fix tests under colord >= 1.4.3. (#908900)
  • Drop print() statement in PPU tests.
• Marek Marczykowski-Górecki:
  • Try fuzzy matching for non-text JSON files too. (#909122)
• Mattia Rizzolo:
  • Use the new debhelper-compat virtual dependency.

Test framework development

There were a number of updates to our Jenkins-based testing framework that powers tests.reproducible-builds.org this week, including:

• Holger Levsen made a huge number of changes to the framework’s Arch Linux support, including:

  • Refactoring for huge performance gains, including a huge rework of the scheduler, dropping 8000 SQL queries
  • Drafting a plan on how to switch to SQL-based HTML page generation.
  • A large number of bug fixes, including removing various “Bashims”, preventing the scheduling of blacklisted packages and ensuring notifications are not sent when they affect no packages.
  • In addition more debug output (1, 2, etc.) was added to catch future errors.
  • The output of rescheduled packages was changed to be sorted. (1, 2)
  • In Debian, Holger also doubled the size of /tmp on the pb3+4 nodes and ensured that rm -rf was called with --one-file-system.

• Hans-Christoph Steiner added the Android Tools Team packages as a “package set”.

• Lastly, Mattia Rizzolo temporarily marked the jtk1b-armhf-rb.debian.net node as offline.

Misc.

This week’s edition was written by Bernhard M. Wiedemann, Chris Lamb, Daniel Shahaf, Holger Levsen, Jelle van der Waa, Vagrant Cascadian & reviewed by a bunch of Reproducible Builds folks on IRC & the mailing lists.