Reproducible Builds: Weekly report #190

Here’s what happened in the Reproducible Builds effort between Sunday December 9th and Saturday December 15th 2018:

• We had an extremely rewarding and productive Reproducible Builds summit in Paris, France. Thank you to all who participated and helped organise the event.

  A full and in-depth report about the event is being prepared but in the meantime Jelle van der Waa published a blog post with a brief report of the event from an Arch Linux perspective and Bernhard M. Wiedemann posted his own report to his openSUSE blog.

  We would also like to thank Mozilla, Ford Foundation, Open Technology Fund, Google Open Source Research, Debian and Protocol Labs for sponsoring the event and for Aspiration Tech for their facilitation work.

  T-shirts with the Reproducible Builds logo were also distributed at the event. If you are a contributor to Reproducible Builds and want a t-shirt, please send an email to Holger as outlined in this mail. The design is freely available in the reproducible-promo-material Git repository if you wish to print one yourself.

• Following on from a session at our summit, Bernhard M. Wiedemann started a thread on our mailing list discussing Reproducible Builds through a mathematical formalism perspective.

• Chris Lamb updated the Lintian quality-assurance tool for Debian packages to check for files that reference the build path. (#916021)

• Bernhard M. Wiedemann noticed that Qt’s rcc had finally merged the patch to use SOURCE_DATE_EPOCH for reproducible .qrc files. In addition, Chris Lamb filed Debian bug #916425 with a patch for python-ruffus to fix a reproducibility issue there too.

• Jelle van der Waa, inspired by Bernhard’s recent RPM ecosystem update, posted an equivalent update of Reproducible Builds in Arch Linux to our mailing list.

• Bernhard M. Wiedemann submitted strip-nondeterminism-1.0.0 to openSUSE.

• Chris Lamb started to merge in new style guide to our project website, adding an example “work in progress” typography page […] and also corrected some references to “non-determinism” […]. In addition, Holger Levsen updated our project’s website to add Microsoft as an attendee of our summit in Paris […] and added a group photo taken by Morten Linderud […].

diffoscope development

diffoscope is our in-depth “diff-on-steroids” utility which helps us diagnose reproducibility issues in packages. There was considerable activity this week, including contributions from:

• Chris Lamb:
  • Fix a test_mozzip_compressed_files test failure under Alpine Linux. (#916353)
  • Calculate the path to a test .icc file using data() to avoid a “Fixtures are not meant to be called directly” warning/error. (#916226)
  • Drop debbindiff Breaks/Replaces. […]
  • Use File.file_header to simplify file detection. ([…], […] & […])
  • Correct a “positives” typo. […]
• Holger Levsen:
  • Clarify that upstream issues should be now reported via Salsa. […]
• Joachim Breitner:
  • Add support for comparing WebAssembly modules. (!17)
• Mattia Rizzolo:
  • Try matching for MozillaZipFile before ZipFile. […]

Chris Lamb also overhauled the diffoscope.org website, updating the design […] as well as informing users that they should file issues on salsa […] and adding corresponding link to our Salsa registration instruction […].

Test framework development

There were a number of updates to our Jenkins-based testing framework that powers tests.reproducible-builds.org this week, including:

• Chris Lamb:
  • Add a PureOS default installation package set. (!24)
  • Avoid double spaces in IRC output. (!23)
• Mattia Rizzolo:
  • Arch Linux-specific changes:
    • Define DISTROID variable before using it. […]
    • Check for the correct distribution when querying the database. […]
  • Debian-specific changes:
    • Only build the index_notify page for Debian. […]
    • Adjust the APT pinning on arm64 to install Munin from backports.debian.org. […]
  • openSUSE-specific changes:
    • Decode the input before giving it to json […]
    • Notify IRC and Bernhard of job failures. […]
    • Add a job importing the openSUSE status into the database to build some HTML pages. […]
    • Use --ignore-missing-files to not warn about missing build logs. […]
  • Misc/generic changes:
    • Add openSUSE, Arch Linux and Alpine Linux to the list of “known” distributions. […]
    • Convert the stats_build.build_duration field type from TEXT to INTEGER. […]
    • Add a distribution field to the sources. […]
    • Change the data type used to store timestamps. […]
    • Various bits node maintenance. (eg. […])

---

This week’s edition was written by Bernhard M. Wiedemann, Chris Lamb, Holger Levsen & reviewed by a bunch of Reproducible Builds folks on IRC & the mailing lists.