Reproducible Builds: Weekly report #194

Here’s what happened in the Reproducible Builds effort between Sunday January 6 and Saturday January 12 2019:

• Reproducibility patches for GNU mtools finally entered the Debian unstable distribution via Chris Lamb’s upload of the mtools 4.0.23-1 package via the “salvaging”. In light of this, Chris rebased his merge request to make the Debian Installer images reproducible, responded to some subsequent code review and re-opened the discussion on the corresponding bug report.

• This week has seen lots of progress on an initial implementation of -fmacro-prefix-map and -ffile-prefix-map in the LLVM compiler toolkit. This may make it into Clang’s 8.0 branch, to be created next week.

• Chris Lamb opened Debian bug #918480, requesting that the squashfs-tools package (which creates and manipulates read-only compressed file systems) moves to the squashfskit fork maintained by Alexander “lynxis” Couzens. However, it transpired that most of the changes required for the generation of reproducible squashfs filesystem images have been merged upstream modulo two patches that Chris rebased & backported and were subsequently uploaded in squashfs-tools 1:4.3-8 by the Debian maintainer, Laszlo Boszormenyi.

• Arnout Engelen’s thread on our mailing list regarding how to share rebuilder “attestations” in the Java ecosystem is ongoing.

• On Wednesday 9th Chris Lamb gave a talk at Université de Rennes, France on reproducible builds. Thank you to Mathieu Goessens for organising this event.

• Holger Levsen uploaded koji 1.16.0-3 to Debian unstable to add missing dependencies on python-requests and python-dateutil, fixing Debian bug #918780.

• Igor Dvorzhak’s merge request against strip-nondeterminism (our tool that post-processes files to remove known non-deterministic output) in order to parallelise the execution of the dh_strip_nondeterminism(1) utility and .zip handler was reviewed and merged by Chris Lamb.

• Chris Lamb updated diffoscope (our in-depth “diff-on-steroids” utility which helps us diagnose reproducibility issues in packages) to add a note to the “Files similar despite different names” comment to clarify that a lower score is more similar […] and to prefer to emit a comment that files are “identical” rather than having a “fuzziness score of zero” […].

• 6 Debian package reviews were added, 9 were updated and 4 were removed in this week, adding to our knowledge about identified issues. Chris Lamb also added a new buildpath_in_binaries_generated_by_ada_compiler toolchain issue and finally added note regarding scdoc […].

Packages reviewed and fixed, and bugs filed

• Bernhard M. Wiedemann:
  • curl (fix FTBFS-2028)
  • erlang (date & time)
  • gasnet (hostname, rejected upstream)
  • libqt5-qtbase (finally use SOURCE_DATE_EPOCH, already upstream)
  • osmo-iuh (time, user, already upstream)
  • python-pysaml2 (FTBFS-2020)
  • semi-xemacs (possible race; to be dropped)
• Chris Lamb:
  • #918533 filed against gnucap-python (use portable printf escapes)
  • squashfskit (use time(0) instead of time(-1))
  • vit (merged: date --utc) (#918534)

Website development

There were a number of updates to the reproducible-builds.org project website this week, including:

• Chris Lamb:
  • Add the Paris summit event documentation. […]
  • On large displays, don’t use the entire width to display text. […]
  • Move the specific event pages under their respective directories in the source tree. […]
• Holger Levsen:
  • Add a link to the Arch Linux developer wiki page. […]
  • Add a link to HTML version of Aspiration’s report to the Paris event page. […]

Test framework development

There were a number of updates to our Jenkins-based testing framework that powers tests.reproducible-builds.org this week, including:

• Holger Levsen:
  • Arch Linux-specific changes:
    • Use Debian’s sed, untar and others with sudo as they are not available in the bootstrap.tar.gz file ([…], […], […], […], etc.).
    • Fix incorrect sudoers(5) regex. […]
    • Only move old schroot away if it exists. […]
    • Add and drop debug code, cleanup cruft, exit on cleanup(), etc. ([…], […])
    • cleanup() is only called on errors, thus exit 1. […]
  • Debian-specific changes:
    • Revert “Support arbitrary package filters when generating deb822 output” ([…]) and re-open the corresponding merge request
    • Show the total number of packages in a package set. […]
  • Misc/generic changes:
    • Node maintenance. ([…, […], […], etc.)
• Mattia Rizzolo:
  • Fix the NODE_NAME value in case it’s not a full-qualified domain name. […]
  • Node maintenance. ([…], etc.)
• Vagrant Cascadian:
  • Reinstall failed disk in armhf node
  • Node maintenance (disk issues, kernel issues/upgrades/downgrades, firmware upgrades, etc.)

---

This week’s edition was written by Bernhard M. Wiedemann, Chris Lamb, Holger Levsen & reviewed by a bunch of Reproducible Builds folks on IRC & the mailing lists.