Documentation II

riseup notepad for facillitating feedback: FAQ Feedback

• https://reproducible-builds.org/
• https://wiki.debian.org/ReproducibleBuilds - should deprecate / eventually delete this
• https://tests.reproducible-builds.org/ - surprisingly hard to find yet it has the most interesting and current info, not just for Debian but other projects’ package sets

Personas

• users
  • what does a user need to know to make a package build reproducibly?
  • what is a reproducible build?
  • link to definition
• upstreams
  • how do i make my software reproducible?
  • how to avoid certain programming pitfalls?
  • timestamps, etc. link to FAQ for upstream?
• package maintainers (Debian specific?)

Homepage

• Definition for RB (to be defined)

Involved Projects

Current status? no, it will get out of date quicker than anyone can update it

• Debian - 92% of source packages are reproducible (link to tests.r-b.o ?)
• FreeBSD - base is mostly ok, loader not, kernel not (but some patch/flag exists), ports (80% with external patch on the framework)

distro / project-specific pages!

• find a list of contacts for these projects and propose them to add information to the website or to send a link to their documentation,

• also ask them to add a contact for RB who people can talk to

• Debian: https://lists.reproducible-builds.org/listinfo/rb-general, IRC: #debian-reproducible @ OFTC
• ArchLinux
• Baserock
• Bitcoin
• Coreboot: ask lynxis
• ElectroBSD: https://archive.fosdem.org/2016/schedule/event/electrobsd/
• F-Droid
• FreeBSD: -> email alias or ML to be provided (reproducibility@FreeBSD.org)
• Fedora
• Guix
• LEDE
• NetBSD
• NixOS
• openSUSE
• OpenWRT: ask lynxis
• Tails: Public development list: tails-dev@boum.org

Debian-related

• don’t forget to copy and then remove current Debian wiki pages

Top level pages

• adding talks page! (most from debian), videos
• reproducible builds definition

Projects

• add bazel to tool page

FAQ sections (instead of personified personas, let’s ask concrete questions!)

introduction to faq: to add things/links that does fit into five sections

• “what is reproducible builds?”
• “what is the status of reproducible builds?”
• “why should I (as a user) care about reproducible builds?”

(single page so it is easier to search everything at once)

• I’m interested in verifying the reproducibility of software I use
• I’m interested in making reproducible software
• I’m interested in packaging/distributing software in a reproducible way
• But it still doesnt work! -> link to Currently unresolved issues
• What are the benefits of reproducible builds
• how can help with license compliance
• (take the work on use cases and side-benefits and put it here)
• I don’t think reproducible builds are actually useful
• here we need to answer all the questions like “I want to hardcode paths” etc.
• why can’t we just normalise the <build path, environment, dependencies, whatever>?
• I really like <timestamps, machine/person who built the binary>!
• how to build your how build farm?

Get involved page

• A “Get involved” page should be created
• it should link to Currently Unresolved Issues
• see https://wiki.debian.org/ReproducibleBuilds/Contribute for an out-of-date list of stuff we had before

FAQ

1/ how to deal with compression tools?

• GZIP: use gzip -n
  • how do I make (GZIP, etc…) give reproducible output? (section: projects)

2/ why is reproducibility important? * where do I get information for XYZ? (section: users)

3/ why using SOURCE_DATE_EPOCH and not simply set everything to 0 (epoch time) lots of build system will reject dealing with files that have a timestamp that old (we need concrete example (section: project)

4/ how to write reproducible code in specific languages - e.g. Rust, Go

• Python: Pyc files, PYTHONHASHSEED
• C: uninitialized memory (msan, asan), readdir order
• emacs bytecode
• how/who to contact for cross distro collaboration? answer: here!
• how to handle signatures in binaries
• squashfs?

To be discussed

• Merge /tools to the documentation?

How to get involved?

• how to help various projects?
• how to help with documentation?
• how to help with outreach
• how can I sponsor the effort?

Talks

• http://www.bsdcan.org/2016/schedule/events/714.en.html
• https://archive.fosdem.org/2016/schedule/event/reproducible_freebsd_packages/
• https://osem.seagl.org/conference/seagl2016/program/proposal/166
• OpenWrt/LEDE: video: https://www.youtube.com/watch?v=Y1D706JCISw, slides: https://people.debian.org/~holger/2016-10-13-OpenWrt-Summit.pdf
• DebConf16: https://debconf16.debconf.org/talks/7/
• LibrePlanet: https://media.libreplanet.org/u/libreplanet/collection/beyond-reproducable-builds/

Tools

• where to find the tools