What happened in the Reproducible Builds effort between April 24th and 30th 2016.
Media coverage
Reproducible builds were mentioned explicitly in two talks at the Mini-DebConf in Vienna:
- Martin Michlmayr had a talk in which he presented an overview about innovations and changes in Debian in the last years. Martin expressed his disappointment that there was no talk from us in Vienna (we’ll fix this at DebConf16 in Cape Town) and described the reproducible builds work as “a real innovation”. His talk is very much worth seeing, whatever your current perspective, it might change your view on Debian.
- Ben Hutchings explains how Secure Boot will use signed kernels via separate signature packages and how this was designed with reproducible builds in mind.
Aspiration together with the OTF CommunityLab released their report about the Reproducible Builds summit in December 2015 in Athens.
Toolchain fixes
Now that the GCC development window has been opened again, the SOURCE_DATE_EPOCH patch by Dhole and Matthias Klose to address the issue timestamps_from_cpp_macros (__DATE__ / __TIME__) has been applied upstream and will be released with GCC 7.
Following that Matthias Klose also has uploaded gcc-5/5.3.1-17 and gcc-6/6.1.1-1 to unstable with a backport of that SOURCE_DATE_EPOCH patch.
Emmanuel Bourg uploaded maven/3.3.9-4, which uses SOURCE_DATE_EPOCH for the maven.build.timestamp.
(SOURCE_DATE_EPOCH specification)
Other upstream changes
Alexis Bienvenüe submitted a patch to Sphinx which extends SOURCE_DATE_EPOCH support for copyright years in generated documentation.
Packages fixed
The following 12 packages have become reproducible due to changes in their build dependencies: hhvm jcsp libfann libflexdock-java libjcommon-java libswingx1-java mobile-atlas-creator not-yet-commons-ssl plexus-utils squareness svnclientadapter
The following packages have became reproducible after being fixed:
- anope/2.0.3-2 by Dominic Hargreaves, #820152 by Alexis Bienvenüe.
- apparmor-profiles-extra/1.7 by intrigeri, patch by Felix Geyer.
- basket/2.10~beta+git20160425.b77687f-1 by Luigi Toscano, original patch by Alexis Bienvenüe.
- bind-dyndb-ldap/8.0-2 by Timo Aaltonen.
- bliss/0.73-1 by Jerome Benoit.
- gap-alnuth/3.0.0-3 by Bill Allombert.
- gap-radiroot/2.7-2 by Bill Allombert.
- genometools/1.5.8+ds-3 by Sascha Steinbiss.
- gprbuild/2015-3 by Nicolas Boulenguez.
- gtkhash/0.7.0-3 by Mònica Ramírez Arceda.
- josm/0.0.svn10161+dfsg-1 by Bas Couwenberg.
- libjgoodies-animation-java/1.4.3-1 by Markus Koschany.
- ltrsift/1.0.2-7 by Sascha Steinbiss.
- mutt/1.6.0-1 by Matteo F. Vescovi, original patch by Daniel Shahaf.
- netsniff-ng/0.6.1-1 by Kartik Mistry, original patch by Reiner Herrmann.
- netrw/1.3.2-3 by Giovanni Mascellani.
- openthesaurus/20160424-3 by Rene Engelhard, original patch by Dhole.
- php-pear/1:1.10.1+submodules+notgz-8 by Mathieu Parent.
- samba/2:4.4.2+dfsg-2 by Jelmer Vernooij.
- swift/2.7.0-3 by Ondřej Nový.
- tp-smapi/0.42-1 by Evgeni Golov, original patch by Chris Lamb.
- vifm/0.8.1a-0.1 by Ondřej Nový.
- xfonts-mplus/1:2.2.4-2 by Hideki Yamane, original patch by Chris Lamb.
- xpa/2.1.17-2 by Ole Streicher, original patch by Alexis Bienvenüe.
Some uploads have fixed some reproducibility issues, but not all of them:
- camitk/4.0.0~beta-1 by Emmanuel Promayon, original patch by Maria Valentina Marin.
- elastix/4.8-8 by Gert Wollny.
- freefem++/3.46+dfsg1-1 by Dimitrios Eftaxiopoulos, original patch by Alexis Bienvenüe.
- grib-api/1.15.0-1 by Alastair McKinstry, original patch by Santiago Vila.
- isorelax/20041111-9 by Emmanuel Bourg.
- libical/2.0.0-0.1 by Andreas Henriksson, original patch by Chris Lamb.
- sawfish/1:1.11.90-1 by Jose M Calhariz, original patch by Alexis Bienvenüe.
- singular/4.0.3-p1+ds-1 by Jerome Benoit.
- syslinux/3:6.03+dfsg-12 by Mattia Rizzolo, original patch by Reiner Herrmann.
- transdecoder/2.0.1+dfsg-3 by Michael R. Crusoe, original patch by Dhole.
Patches submitted that have not made their way to the archive yet:
- #822566 against stk by Alexis Bienvenüe: sort lists of object files for reproducible linking order.
- #822948 against shotwell by Alexis Bienvenüe: normalize tarball permissions and use locale/timezone-independent modification time.
- #822963 against htop by Alexis Bienvenüe: use SOURCE_DATE_EPOCH for embedded copyright year, which has before already been applied in git and upstream.
Package reviews
95 reviews have been added, 15 have been updated and 129 have been removed in this week.
22 FTBFS bugs have been reported by Chris Lamb and Martin Michlmayr.
diffoscope development
- diffoscope 52~bpo8+1 has been uploaded to jessie-backports by Mattia Rizzolo, where it is currently waiting for NEW-approval.
- Support for the deb(5) format (uncompressed data.tar/control.tar, control.tar.xz) (Closes: #818414) has been completed by Reiner Herrmann in git.
strip-nondeterminism development
- Support for EPUB documents has been added (to the development version in git) by Holger Levsen, to address the timestamps_in_epub issue.
tests.reproducible-builds.org
- To monitor the uptodateness of diffoscope everywhere, tests checking this on FreeBSD, NetBSD & MacPorts were added. Tests on other distributions will be added once the relevant bugs in whohas are fixed in jessie. (h01ger)
Misc.
Amongst the 29 interns who will work on Debian through GSoC and Outreachy there are four who will be contributing to Reproducible Builds for Debian and Free Software. We are very glad to welcome ceridwen, Satyam Zode, Scarlett Clark and Valerie Young and look forward to working together with them the coming months (and maybe beyond)!
This week’s edition was written by Reiner Herrmann and Holger Levsen and reviewed by a bunch of Reproducible builds folks on IRC.
