201.md 7.18 KB
Newer Older
1 2 3
---
layout: new/blog
week: 201
4
published: 2019-03-05 13:14:43
5 6
---

Chris Lamb's avatar
Chris Lamb committed
7
Here's what happened in the [Reproducible Builds](https://reproducible-builds.org) effort between Sunday February 24 and Saturday March 2 2019:
Holger Levsen's avatar
Holger Levsen committed
8

Chris Lamb's avatar
Chris Lamb committed
9
* On Tuesday 26th Chris Lamb spoke at [Speck&Tech 31 "Open Security"](https://www.eventbrite.com/e/specktech-31-open-security-tickets-53503912643) on Reproducible Builds.
10

Chris Lamb's avatar
Chris Lamb committed
11 12
* On [our mailing list](https://lists.reproducible-builds.org/pipermail/rb-general/) this week:
    * Eric Myhre [posted about the developer of Dwarf Fortress reporting](https://lists.reproducible-builds.org/pipermail/rb-general/2019-February/001473.html) some "butterfly-effect style" bugs in deterministic world generation in a post titled [*Reproducible builds: it's not just for compilers, it's for dwarfs too.  And their entire universe...!*](http://www.bay12games.com/dwarves/#2019-02-21).
13
    * Holger Levsen posted an update after he calculated that [Debian is 54% reproducible in practice](https://lists.reproducible-builds.org/pipermail/rb-general/2019-March/001479.html). This also revealed that 12% of all binary packages in `buster/amd64` are unreproducible because they were built by binNMUs ([#894441](https://bugs.debian.org/894441)).
14

15 16
* On Saturday 3rd Holger participated in a panel at the demo day of the [4th round of the Prototype Fund](https://prototypefund.de/projects/round4/) were he talked about [Reproducible Builds in reality](https://prototypefund.de/project/reproducible-builds-in-der-wirklichkeit/) which is summarised below:
    ![]({{ "/images/blog/201/reproducible-builds-PTF-demo-day-20190302.png" | prepend: site.baseurl }})
Holger Levsen's avatar
Holger Levsen committed
17

Chris Lamb's avatar
Chris Lamb committed
18
* Alexander "*lynxis*" Couzens [announced the first release](https://bugs.debian.org/918480#42) of [`squashfskit`](https://github.com/squashfskit/squashfskit), a set of utilities that create and manipulate read-only compressed file systems that was forked from `squashfs-tools`.
19

Chris Lamb's avatar
Chris Lamb committed
20
* Bernhard M. Wiedemann [posted his monthly Reproducible Builds status update](https://lists.opensuse.org/opensuse-factory/2019-02/msg00599.html) for the [openSUSE](https://opensuse.org/) distribution. This includes some verification of official builds, where 81.2%-similar (NB. not yet bit-identical build results were achieved.
21

Chris Lamb's avatar
Chris Lamb committed
22
* Graham Christensen corrected some broken links on the [reproducible-builds.org](https://reproducible-builds.org) project website. [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/43ba1a1)][[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/a691971)]
23

Chris Lamb's avatar
Chris Lamb committed
24
* Holger uploaded version `1.16.2-1` of [koji](https://pagure.io/koji) — the RPM building and tracking system — to Debian, fixing [CVE-2018-1002161](https://security-tracker.debian.org/tracker/CVE-2018-1002161) to address a SQL injection attack. ([#922922](https://bugs.debian.irg/922922))
25

Chris Lamb's avatar
Chris Lamb committed
26 27 28 29 30 31 32 33 34 35 36 37
* A tool to [compare the differences between between two versions of the same Node "npm" package](https://diff.intrinsic.com/) was released, speaking to the same concerns for code provenance that the Reproducible Builds project has.

* 15 Debian package reviews were added, 3 were updated and 14 were removed in this week, adding to [our knowledge about identified issues](https://tests.reproducible-builds.org/debian/index_issues.html).

## diffoscope development

[![]({{ "/images/blog/201/diffoscope.svg" | prepend: site.baseurl }})](https://diffoscope.org)

[diffoscope](https://diffoscope.org/) is our in-depth "diff-on-steroids" utility which helps us diagnose reproducibility issues in packages. This week:

* Chris Lamb:
    * Improved the displayed comment when falling back to a binary diff to include the file type. [(#49)](https://salsa.debian.org/reproducible-builds/diffoscope/issues/49)
heinrich5991's avatar
heinrich5991 committed
38
    * Tidied definition of "no file-specific differences were detected" message suffix. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/a671bfb)]
Chris Lamb's avatar
Chris Lamb committed
39 40 41
    * Corrected a "recurse" typo. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/d41f09b)]

* Vagrant Cascadian updated diffoscope in [GNU Guix](https://www.gnu.org/software/guix/). [[...](https://git.savannah.gnu.org/cgit/guix.git/commit/?id=6dacaa70a0874662cbdabfc6df987cd5a09a518c)]
Bernhard M. Wiedemann's avatar
Bernhard M. Wiedemann committed
42 43 44 45

## Packages reviewed and fixed, and bugs filed

* Bernhard M. Wiedemann:
Bernhard M. Wiedemann's avatar
Bernhard M. Wiedemann committed
46
    * [scons](https://github.com/SCons/scons/pull/3312) (merged, hostname)
Bernhard M. Wiedemann's avatar
Bernhard M. Wiedemann committed
47
    * [nfs-ganesha](https://build.opensuse.org/request/show/679666) (hostname)
Bernhard M. Wiedemann's avatar
Bernhard M. Wiedemann committed
48 49 50 51 52
    * [openstack-manila](https://build.opensuse.org/request/show/680412) (hostname)
    * [eigen3](https://build.opensuse.org/request/show/679669) (drop LaTeX `.log`, [partially submitted and merged upstream](https://bitbucket.org/eigen/eigen/pull-requests/598/do-not-keep-latex-logs/diff))
    * [python-HTTPolice](https://github.com/vfaronov/httpolice/pull/9) (merged, fix FTBFS-2021)
    * [python-keystoneclient](https://review.openstack.org/640024) (fix FTBFS-2020)
    * [cassandra](https://issues.apache.org/jira/browse/CASSANDRA-15039) (fix date/copyright year)
53 54
    * [various openstack rpms](https://review.openstack.org/640293) (drop `.pickl` files)
    * [heimdal](https://github.com/heimdal/heimdal/issues/529) (report FTBFS with `-j1`)
Chris Lamb's avatar
Chris Lamb committed
55 56 57 58 59

* Chris Lamb:
    * [#923169](https://bugs.debian.org/923169) filed against [node-lunr](https://tracker.debian.org/pkg/node-lunr).
    * [#923170](https://bugs.debian.org/923170) filed against [heudiconv](https://tracker.debian.org/pkg/heudiconv).

heinrich5991's avatar
heinrich5991 committed
60
In addition, one of Chris Lamb's previous patches for the [Sphinx](https://sphinx-doc.org) documentation system [was merged upstream](https://github.com/sphinx-doc/sphinx/pull/6028#issuecomment-467885608). He also [updated his branch against](https://github.com/shadow-maint/shadow/pull/146#issuecomment-468750829) the `shadow` password utility.
Chris Lamb's avatar
Chris Lamb committed
61 62 63 64 65

## Test framework development

We operate a comprehensive [Jenkins](https://jenkins.io/)-based testing framework that powers [tests.reproducible-builds.org](https://tests.reproducible-builds.org). This week, Holger Levsen made the following improvements:

heinrich5991's avatar
heinrich5991 committed
66
* Improve the output of the Debian reproducible "SHA1" checker [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/5a50d32f)], also including stats for non-reproducible binNMUs, `arch:all` and `arch:amd64` packages [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/151b4f00)].
Chris Lamb's avatar
Chris Lamb committed
67
* Deal with zero results in the SHA1 checker. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/38bf9944)]
Chris Lamb's avatar
Chris Lamb committed
68 69
* Move SHA1 checker to `osuosl173` node. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/2d0205d5)]
* Add `setup_schroot_buster_diffoscope` job on `osuosl173` node. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/8532fd178)]
Chris Lamb's avatar
Chris Lamb committed
70 71 72 73 74
* Node maintenance. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/efbe90df)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/2d0205d5)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/b700d342)]

In addition, Mattia Rizzolo performed some `armhf` node maintenance. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/50f250b9)]

---
75

Chris Lamb's avatar
Chris Lamb committed
76
This week's edition was written by Bernhard M. Wiedemann, Chris Lamb, Holger Levsen, Vagrant Cascadian & reviewed by a bunch of Reproducible Builds folks on IRC & the mailing lists.