Reproducible Builds: Weekly report #175

Here’s what happened in the Reproducible Builds effort between Sunday August 26 and Saturday September 1 2018:

• Bernhard M. Wiedemann wrote an article on the SUSE Blog entitled “Extending trust in our binaries: No backdoors have been found” on the current status of reproducible builds in SUSE.

• Mes (a Scheme-based compiler for our “sister” bootstrappable builds effort) announced their 0.17 release and them becoming a GNU project

• Jelle van der Waa discussed the removal of svn $Id$ substitutions in Arch Linux to make builds reproducible.

• Chris Lamb uploaded version 100 of diffoscope (our in-depth “diff-on-steroids” utility which helps us diagnose reproducibility issues in packages) was uploaded to Debian unstable, closing 8 bugs.

• There were further updates for our website including Arnout Engelen adding Maven and the sbt build tool projects and introducing a link from the footer to sections in ‘who’. Chris Lamb also added Jelle van der Waa talk to our resources page […], added Monero to the Who is Involved? page and added the relevant DebConf 18 presentations to our database […].

• 6 Debian package reviews were added, 7 were updated and 9 were removed in this week by Chris Lamb, adding to our knowledge about identified issues.

Patches filed

• Bernhard M. Wiedemann:

  • amazon-ecs-init (random buildpath(go))
  • bind-formula (sort a hash in saltstack/jinja2)
  • godot (merged, 3xsort +bugfix, date / year)
  • ImageMagick to not add a build date into .PNG. files.
  • python-Fabric3 (FTBFS/timeout -j1)
  • python-dukpy-kovidgoyal (merged, sort readdir(2))
  • python-pyodbc (sort readdir(2))
  • rpm to ensure SOURCE_DATE_EPOCH is in the past (for mtime-clamping).
  • vrui (drop time)

• Chris Lamb:

  • grunt (merged, date)
  • libgit2-glib
  • marked-man (merged, date)
  • mblaze (use correct SOURCE_DATE_EPOCH name) (#907537)
  • promise (updated, random, sort readdir(2))
  • python-os-faults
  • rawtherapee
  • redis (merged, date, hostname)
  • sphinx-gallery

tests.reproducible-builds.org development

There were a number of updates to our Jenkins-based testing framework that powers tests.reproducible-builds.org this week, including:

• Chris Lamb:
  • Escape package name in “Schedule a new build” links.
• Holger Levsen:
  • Don’t fail maintenance job if there are no old artifacts to delete.
  • Remove old node entries which are older than two weeks. (#907497)
• Mattia Rizzolo:
  • Escape package names in another case too.

Misc.

This week’s edition was written by Bernhard M. Wiedemann, Chris Lamb, Holger Levsen, Mattia Rizzolo & reviewed by a bunch of Reproducible Builds folks on IRC & the mailing lists.