If you’re interested in attending the Reproducible Builds summit in Paris between 11th—13th December please see our event page.
In the meantime, here’s what happened in the Reproducible Builds effort between Sunday October 28 and Saturday November 3 2018:
Vagrant Cascadian has probed the Debian package archives and found that in the current Debian
sid, 88 out of the 154 (57%) Debian binary packages installed in a minimal system can be verifiably reproduced.
For a long time, 25,561 out of 27,427 (93%) of the total source packages in the Debian archive have been known to be reproducible in a our testing environment. While 57% is a lower figure it could be considered a more substantial statistic as it is not a measure of packages that behave well under carefully controlled conditions but of “real world” Debian artifacts that are installed on end-user systems.
Félix Sipma submitted a merge request to the Debian “Go” build tools to support the
-trimpath=all=argument which should fix the reproducibility of
resticas well the categorised
disorderfs (our FUSE-based filesystem that deliberately introduces non-determinism into filesystems) was updated by Bernhard M. Wiedemann to rename test files to
test_to make them easier to iterate over ([…]) and moving the test execution logic into
Makefileto not require a separate script ([…]). After this, Chris Lamb tidied the
Chris Lamb noticed that the webpages for the CLIP OS project which aims to build a “hardened, multi-level operating system based on the Linux kernel” lists bit-for-bit reproducibility in its security roadmap. (via LWN)
59 Debian package reviews were added, 7 were updated and 17 were removed in this week, adding to our knowledge about identified issues. Chris Lamb updated one issue type (
randomness_in_binaries_generated_by_golang) and two were added (
Molly de Blanc forwarded a call for applications for the Berkman Klein Center for Internet and Society in Cambridge, Massachusetts class of fellows who do research around the intersection of the internet, society, technology, etc. which may be relevant to anyone speaking, thinking, and writing around the implications of Reproducible Builds.
There were a number of updates to our Jenkins-based testing framework that powers tests.reproducible-builds.org by Holger Levsen this week, mostly fighting the load introduced from a number of bots (eg. […]) but also enhancing the performance of Jenkins via adjusting Java’s garbage collection and heap size settings (eg. […]).
We’ve been experiencing a high load in our test framework in the last week which we experienced some weeks ago as well after a Jenkins plugin update. However, this time Holger has not been able to get this under control yet and, as such, some test results are currently delayed.
Packages reviewed and fixed, and bugs filed
- Alexander Bedrossian:
- equivs (remove current date)
- Amit Biswas:
- Anoop Nadig:
- Bernhard M. Wiedemann:
- Chris Lamb:
- Mathieu Parent:
- Maliat Manzur:
- biboumi (used
- biboumi (used
- Nick Gregory:
- Snahil Singh:
- firehol (used
- firehol (used
This week’s edition was written by Alexander Bedrossian, Amit Biswas, Anoop Nadig, Bernhard M. Wiedemann, Chris Lamb, David A. Wheeler, Holger Levsen, Snahil Singh, Nick Gregory & reviewed by a bunch of Reproducible Builds folks on IRC & the mailing lists.