Reproducible Builds: Weekly report #177

Here’s what happened in the Reproducible Builds effort between Sunday September 9 and Saturday September 15 2018:

• The fourth Reproducible Builds summit will take place from December 11th → 13th 2018 at the Mozilla Office. in Paris, France. If you are interested in attending please register by sending an email to holger@layer-acht.org. More details may be found on the associated event page.

• The Scala programming language merged a number of improvements to make the output from its compiler more reproducible. This work is available in the fifth milestone for the upcoming 2.13.0 release and is intended to be backported to the 2.12 tree.

• The program for NixOS’s 2018 conference was published this week — NixOS’s declarative package manager aims to make package management reliable and reproducible.

• The Briar secure messenger project published a blog post entitled “Building Briar Reproducible and Why It Matters”.

• A number of changes were made to systemd in order that it builds reproducibly. The issues were related to the test fixtures embedding the build path.

• Johannes Schauer (josch) created a merge request for the Debian Package Tracker to address that our test framework updated an internal API.

• Chris Lamb reviewed 43 Debian packages, adding to our knowledge about identified issues as well as updating a number of issue types including adding a note from upstream on the graphviz_nondeterminstic_output issue via a Tweet adding adding a new randomness_in_pdf2htmlex_html_output toolchain issue.

• There were further updates to our website, including Holger Levsen adding a backdated news entry about the new logo.

Patches filed

• Bernhard M. Wiedemann:

  • 389-ds (version update to fix FTBFS-j1)
  • dateutils (fix FTBFS-2018-10-08)
  • gtk4 (fix FTBFS-j1)
  • mkfontscale (sort readdir(2))
  • pycurl (file FTBFS-j1)
  • python-openstacksdk (FTBFS-j1 / build stuck)
  • various python packages (drop environment.pickle files)

• Chris Lamb:

  • Debian bug #908379 filed against bro.
  • Debian bug #908480 filed against coinmp.
  • gdk-pixbuf (fixed: shared files must be identical)
  • gtk+3.0 (merged, filesystem ordering)
  • promise (merged, use sha512 instead of random)

diffoscope development

Chris Lamb made a large number of changes to diffoscope, our in-depth “diff-on-steroids” utility which helps us diagnose reproducibility issues in packages:

• Ensure Debian substvar generation is deterministic regardless of installed packages. (#908072)
• Fix testsuite under LLVM >= 7.0. (#908074)
• Disable binwalk’s configuration for predictable results, etc. (#903444)
• Clarify distinction between tools and packages when generating substvars.
• Don’t print GPG output.
• Ensure we return bytes objections from Command.filter to prevent LLVM tracebacks.

These changes were then uploaded as diffoscope version 101.

Test framework development

There were a number of updates to our Jenkins-based testing framework that powers tests.reproducible-builds.org by Holger Levsen this week, including:

• Use amd64 kernels on all i386 nodes. (#875990)
• Prevent failures if artifacts cannot be deleted.
• Detect build failures due to invalid characters in package relations, download problems, Git problems, etc.
• Stop complaining about wrong MTU on IRC.
• Update the build variation documentation to reflect we’re currently doing fewer kernel variation tests.
• Force amd64 kernel installation on the i386 architecture.

Misc.

This week’s edition was written by Arnout Engelen, Bernhard M. Wiedemann, Chris Lamb, heinrich5991, Holger Levsen and Vagrant Cascadian & reviewed by a bunch of Reproducible Builds folks on IRC & the mailing lists.