What happened in the Reproducible Builds effort between May 1st and May 7th 2016:
Media coverage
There has been a surprising tweet last week: “Props to @FiloSottile for his nifty gvt golang tool. We’re using it to get reproducible builds for a Zika & West Nile monitoring project.” and to our surprise Kenn confirmed privately that he indeed meant “reproducible builds” as in “bit by bit identical builds”. Wow. We’re looking forward to learn more details about this; for now we just know that they are doing this for software quality reasons basically.
Two of the four GSoC and Outreachy participants for Reproducible builds posted their introductions to Planet Debian:
- Scarlett Clark: Kubuntu: Debian: KDE: Outreachy! Yay! Upcoming changes
- Satyam Zode: Google Summer of Code 2016 With Debian Reproducible Builds : Introduction
Toolchain fixes and other upstream developments
dpkg 1.18.5 was uploaded fixing two bugs relevant to us:
- #719845 (make the file order within the {data,control}.tar.gz .deb members deterministic)
- #819194 (add
-fdebug-prefix-mapto the compilers options)
This upload made it necessary to rebase our dpkg on the version on sid again, which Niko Tyni and Lunar promptly did. Then a few days later 1.18.6 was released to fix a regression in the previous upload, and Niko promptly updated our patched version again. Following this Niko Tyni found #823428: “dpkg: many packages affected by dpkg-source: error: source package uses only weak checksums”.
Alexis Bienvenüe worked on tex related packages and SOURCE_DATE_EPOCH:
- Alexis uploaded texlive-bin to our repo improving the existing patches.
- pdftex upstream discussion by Alexis Bienvenüe began at tex-k mailing list to make \today honour SOURCE_DATE_EPOCH. Upstream already committed enhanced versions of the proposed patches.
- Similar discussion on the luatex side at luatex mailing list. Upstream is working on it, and already committed some changes.
Emmanuel Bourg uploaded jflex/1.4.3+dfsg-2, which removes timestamps from generated files.
Packages fixed
The following 285 packages have become reproducible due to changes in their build dependencies (mostly from GCC honouring SOURCE_DATE_EPOCH, see the previous week report): 0ad abiword abcm2ps acedb acpica-unix actiona alliance amarok amideco amsynth anjuta aolserver4-nsmysql aolserver4-nsopenssl aolserver4-nssqlite3 apbs aqsis aria2 ascd ascii2binary atheme-services audacity autodocksuite avis awardeco bacula ballerburg bb berusky berusky2 bindechexascii binkd boinc boost1.58 boost1.60 bwctl cairo-dock cd-hit cenon.app chipw ckermit clp clustalo cmatrix coinor-cbc commons-pool cppformat crashmail crrcsim csvimp cyphesis-cpp dact dar darcs darkradiant dcap dia distcc dolphin-emu drumkv1 dtach dune-localfunctions dvbsnoop dvbstreamer eclib ed2k-hash edfbrowser efax-gtk efax exonerate f-irc fakepop fbb filezilla fityk flasm flightgear fluxbox fmit fossil freedink-dfarc freehdl freemedforms-project freeplayer freeradius fxload gdb-arm-none-eabi geany-plugins geany geda-gaf gfm gif2png giflib gifticlib glaurung glusterfs gnokii gnubiff gnugk goaccess gocr goldencheetah gom gopchop gosmore gpsim gputils grcompiler grisbi gtkpod gvpe hardlink haskell-github hashrat hatari herculesstudio hpcc hypre i2util incron infiniband-diags infon ips iptotal ipv6calc iqtree jabber-muc jama jamnntpd janino jcharts joy2key jpilot jumpnbump jvim kanatest kbuild kchmviewer konclude krename kscope kvpnc latexdiff lcrack leocad libace-perl libcaca libcgicc libdap libdbi-drivers libewf libjlayer-java libkcompactdisc liblscp libmp3spi-java libpwiz librecad libspin-java libuninum libzypp lightdm-gtk-greeter lighttpd linpac lookup lz4 lzop maitreya meshlab mgetty mhwaveedit minbif minc-tools moc mrtrix mscompress msort mudlet multiwatch mysecureshell nifticlib nkf noblenote nqc numactl numad octave-optim omega-rpg open-cobol openmama openmprtl openrpt opensm openvpn openvswitch owx pads parsinsert pcb pd-hcs pd-hexloader pd-hid pd-libdir pear-channels pgn-extract phnxdeco php-amqp php-apcu-bc php-apcu php-solr pidgin-librvp plan plymouth pnscan pocketsphinx polygraph portaudio19 postbooks-updater postbooks powertop previsat progressivemauve puredata-import pycurl qjackctl qmidinet qsampler qsopt-ex qsynth qtractor quassel quelcom quickplot qxgedit ratpoison rlpr robojournal samplv1 sanlock saods9 schism scorched3d scummvm-tools sdlbasic sgrep simh sinfo sip-tester sludge sniffit sox spd speex stimfit swarm-cluster synfig synthv1 syslog-ng tart tessa theseus thunar-vcs-plugin ticcutils tickr tilp2 timbl timblserver tkgate transtermhp tstools tvoe ucarp ultracopier undbx uni2ascii uniutils universalindentgui util-vserver uudeview vfu virtualjaguar vmpk voms voxbo vpcs wipe x264 xcfa xfrisk xmorph xmount xyscan yacas yasm z88dk zeal zsync zynaddsubfx
Last week the 1000th bug usertagged “reproducible” was fixed! This means roughly 2 bugs per day since 2015-01-01. Kudos and huge thanks to everyone involved! Please also note: FTBFS packages have not been counted here and there are still 600 open bugs with reproducible patches provided. Please help bringing that number down to 0!
The following packages have become reproducible after being fixed:
- crawl/2:0.18.0-1 by Adam Borowski, #823383 by Alexis Bienvenüe.
- eigenbase-resgen/1.3.0.13768-3 by Emmanuel Bourg.
- fpga-icestorm/0~20160218gitf2b2549-2 by Ruben Undheim, #823616 by Daniel Shahaf.
- gap/4r8p3-3 by Bill Allombert, #821302 by Jerome Benoit.
- libksba/1.3.4-1 by Andreas Metzler.
- libusb/2:0.1.12-29 by Aurelien Jarno, #823123 by Daniel Shahaf.
- milkytracker/0.90.86+dfsg-1 by James Cowgill.
- mp4h/1.3.1-15 by Axel Beckert.
- rdtool/0.6.38-4 by Christian Hofstaedtler, #820144 by Alexis Bienvenüe.
- sympow/1.023-7 by Jerome Benoit.
Some uploads have fixed some reproducibility issues, but not all of them:
- freefem++/3.46+dfsg1-2 by Dimitrios Eftaxiopoulosis, #820815 by Alexis Bienvenüe.
- jaligner/1.0+dfsg-2 by Michael R. Crusoe.
- keyutils/1.5.9-9 by Christian Kastner.
- shotwell/0.22.1-1 by Jörg Frings-Fürst.
Uploads which fix reproducibility issues, but currently FTBFS:
Patches submitted that have not made their way to the archive yet:
- #823174 against ros-pluginlib by Daniel Shahaf: use printf instead of echo to fix implementation-specific behavior.
- #823239 against gspiceui by Alexis Bienvenüe: sort list of object files for linking binary.
- #823241 against unhide by Alexis Bienvenüe: sort list of source files passed to compiler.
- #823393 against kdbg by Alexis Bienvenüe: fix changelog encoding and call grep in text mode.
- #823452 against khronos-opengl-man4 by Daniel Shahaf: sort file lists deterministically.
Package reviews
54 reviews have been added, 6 have been updated and 44 have been removed in this week.
18 FTBFS bugs have been reported by Chris Lamb, James Cowgill and Niko Tyni.
diffoscope development
Thanks to Mattia, diffoscope 52~bpo8+1 is available in jessie-backports now.
tests.reproducible-builds.org
- All packages from all tested suites have finally been built on i386.
- Due to GCC supporting SOURCE_DATE_EPOCH sid/armhf has finally reached 20k reproducible packages and sid/amd64 has even reached 21k reproducible packages. (These numbers are about our test setup. The numbers for the Debian archive are still all 0. dpkg and dak need to be fixed to get the numbers above 0.)
- IRC notifications for non-Debian related jenkins job results go to #reproducible-builds now, while Debian related notifications stay on #debian-reproducible. (h01ger)
- profitbricks-build4-amd64 has been fully set up now and is running 398 days in the future. Next: update coreboot/OpenWrt/Fedora/Archlinux/FreeBSD/NetBSD scripts to use it. Help (in form of patches to existing shell scripts) very much welcome! (Other help is much welcome (and needed) too, but some things might take longer to merge or explain…)
Misc.
This week’s edition was written by Reiner Herrmann, Holger Levsen and Mattia Rizzolo and reviewed by a bunch of Reproducible builds folks on IRC. Mattia also wrote a small ikiwiki macro for this blog to ease linking reproducible issues, packages in the package tracker and bugs in the Debian BTS.
