Reproducible Builds: Weekly report #137

Here’s what happened in the Reproducible Builds effort between Sunday December 3 and Saturday December 9 2017:

Documentation update

There was more discussion on different logos being proposed for the project.

Reproducible work in other projects

Cyril Brulebois wrote about Tails’ work on reproducibility

Gabriel Scherer submitted a pull request to the OCaml compiler to honour the BUILD_PATH_PREFIX_MAP environment variable.

Packages reviewed and fixed

Patches filed upstream:

• Bernhard M. Wiedemann:
  • cpython tar/zip - file ordering, sort file lists
• Eli Schwartz:
  • calibre: - hash table ordering
• Foxboron
  • gopass: - use SOURCE_DATE_EPOCH in Makefile
• Jelle
  • PHP: - use SOURCE_DATE_EPOCH for Build Date
• Chris Lamb:
  • pylint - file ordering, nondeterministic data structure
  • tlsh - clarify error message (via diffoscope development)
• Alexander “lynxis” Couzens:
  • mosquitto - remove build timestamp
  • libwebsockets - remove build user/hostname
  • open-plc-utils - remove build timestamp

Patches filed in Debian:

• Chris Lamb:
  • #883376 filed against p4vasp.
  • #883728 filed against designate.
  • #883913 filed against pylint.
  • #884047 filed against bibledit.

Patches filed in openSUSE:

• Bernhard M. Wiedemann:
  • build-compare (merged) - handle .egg as .zip
  • neovim (merged) - hostname, username
  • perl (merged) - date, hostname, username
  • sendmail - date, hostname, username

Patches filed in OpenWRT:

• Alexander “lynxis” Couzens:
  • tcpproxy - remove build timestamp and hostname
  • libwebsockets - remove build hostname
  • lua-rs232 - remove build timestamp
  • wavemon - use SOURCE_DATE_EPOCH as BUILD_DATE
  • asterisk - remove build timestamp
  • sipp - remove build timestamp
  • restund - remove build timestamp
  • zabbix - remove build timestamp
  • uanytun - remove build timestamp and hostname
  • perl - remove build timestamp
  • php7 - remove build timestamp
  • lcdproc - remove build timestamp
  • mosquitto - remove build timestamp
  • kamailio-5.x - remove build timestamp

Reviews of unreproducible packages

17 package reviews have been added, 31 have been updated and 43 have been removed in this week, adding to our knowledge about identified issues.

Weekly QA work

During our reproducibility testing, FTBFS bugs have been detected and reported by:

• Adrian Bunk (13)
• Andreas Beckmann (2)
• Emilio Pozuelo Monfort (3)

reprotest development

• Santiago Torres:
  • Use uname -m instead of arch.

trydiffoscope development

Version 66 was uploaded to unstable by Chris Lamb. It included contributions already covered by posts of the previous weeks as well as new ones from:

• Chris Lamb:
  • Parse dpkg-parsechangelog instead of hard-coding version
  • Bump Standards-Version to 4.1.2
  • flake8 formatting

reproducible-website development

• Holger Levsen:
  • Add documentation from our third summit, as provided by Beatrice Martini from Aspiration Tech

tests.reproducible-builds.org

reproducible Arch Linux:

• Holger Levsen:
  • Scheduler:
    • Randomize the scheduling of packgaes
    • Schedule newer packages so they are built sooner
    • Schedule 250 old packages if nothing else to do
    • Don’t schedule packages that blacklisted
  • Bug fixes:
    • Don’t fail the build if PKGBUILD cannot be sourced
    • Also detect ==> ERROR: Failure while creating working copy as a download failure
    • Don’t use sudo if -u root works
    • Cleanup files before the next build
  • Alerting:
    • Conditionally shorten IRC messages
    • Notify IRC about new daily graphs
  • Reporting/logging:
    • Log which old packages have been rescheduled
    • Output number of currently scheduled packages
    • Show blacklisted packages
    • Correctly create pkg.html for blacklisted packages we don’t know anything about
  • Misc:
    • Blacklist management: Refactoring, blacklist core/gnutls and blacklist ltrace
    • Add pointer to a patch we want to see merged
• anthraxx:
  • Remove Pacman lock in local session
  • Skip GPG checks for future builds re. expired keys
  • Remove overly verbose debugging
• Eli Schwartz:
  • Add variation for /bin/sh
  • Don’t install multilib-devel members manually

reproducible F-Droid:

• Hans-Christoph Steiner:
  • Add all supported VCSs

Misc.

This week’s edition was written by Ximin Luo, Alexander Couzens, Holger Levsen, Chris Lamb, Bernhard M. Wiedemann and Santiago Torres & reviewed by a bunch of Reproducible Builds folks on IRC & the mailing lists.