59.md 14 KB
Newer Older
1
---
2
layout: new/blog
3
week: 59
4
published: 2016-06-15 23:06:12
5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37
---

What happened in the [Reproducible
Builds](https://wiki.debian.org/ReproducibleBuilds) effort between June 5th and June 11th 2016:

Media coverage
--------------

Ed Maste gave a talk at [BSDCan 2016](https://www.bsdcan.org/2016/) on
reproducible builds
([slides](https://www.bsdcan.org/2016/schedule/events/714.en.html),
[video](https://www.youtube.com/watch?v=z7pDnBO5wSM&t=337m0s)).

GSoC and Outreachy updates
--------------------------

Weekly reports by our participants:

- [Scarlett Clark](http://scarlettgatelyclark.com/2016/debian-reproducible-builds-week-2/)
  worked on making some packages reproducible, focusing on KDE backend and
  utility programs.
- [Ceridwen](https://reproducible.alioth.debian.org/blog/posts/people/ceridwen/reprotest_week2/)
  published an initial design for the interface for `reprotest`, including a
  discussion on different types of build variations and the difficulties of
  specifying certain types of variations.
- [Valerie Young](http://www.spectranaut.cc/?p=17) improved documentation for
  building our tests website, began migrating Debian-specific pages into a new
  namespace, and planned future work around its navigation.

Documentation update
--------------------

<a name="FORCE_SOURCE_DATE" />
38
- Ximin Luo [proposed a modification](https://salsa.debian.org/reproducible-builds/source-date-epoch-spec.git/commit/?h=force-source-date&id=4b9da6b7f1aae38b82eaf29deb51bbe150204c76)
39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58
  to our `SOURCE_DATE_EPOCH` spec explaining `FORCE_SOURCE_DATE`.

  Some upstream build tools (e.g. TeX, see below) have expressed a desire to
  control which cases of embedded timestamps should obey `SOURCE_DATE_EPOCH`.
  They were not convinced by our arguments on why this is a bad idea, so we
  agreed on an environment variable `FORCE_SOURCE_DATE` for them to implement
  their desired behaviour - named generically, so that at least we can set it
  centrally. For more details, see the text just linked. However, we strongly
  urge most build tools *not* to use this, and instead obey `SOURCE_DATE_EPOCH`
  *unconditionally in all cases*.

Toolchain fixes
---------------

- TeX Live 2016 [released](https://www.preining.info/blog/2016/06/tex-live-2016-released/)
  with `SOURCE_DATE_EPOCH` support for all engines except LuaTeX and original TeX.
- [Continued discussion](https://www.tug.org/pipermail/tex-k/2016-June/002721.html)
  ([alternative archive](https://lists.alioth.debian.org/pipermail/reproducible-builds/Week-of-Mon-20160606/005698.html))
  with TeX upstream, about `SOURCE_DATE_EPOCH` corner cases, eventually
  resulting in the `FORCE_SOURCE_DATE` proposal from above.
59 60
- [gcc-5](https://tracker.debian.org/pkg/gcc-5)/5.4.0-4 by Matthias Klose now avoids storing
  `-fdebug-prefix-map` in `DW_AT_producer`, thanks to [#819176](https://bugs.debian.org/819176) by
61
  Daniel Kahn Gillmor.
62 63
- [sphinx](https://tracker.debian.org/pkg/sphinx)/1.4.3-1 by Dmitry Shachnev now drops Debian-specific patches
  relating to `SOURCE_DATE_EPOCH` applied upstream, [#820895](https://bugs.debian.org/820895) by Alexis
64
  Bienvenüe.
65 66 67 68
- [asciidoctor](https://tracker.debian.org/pkg/asciidoctor)/1.5.4-2 by Cédric Boutillier now supports
  `SOURCE_DATE_EPOCH`, thanks to [#820435](https://bugs.debian.org/820435) by Alexis Bienvenüe.
- [dh-python](https://tracker.debian.org/pkg/dh-python)/1.5.4-2 by Piotr Ożarowski now behaves better in some
  cases, thanks to [#804339](https://bugs.debian.org/804339) by Chris Lamb.
69 70 71 72 73 74

Packages fixed
--------------

The following 16 packages have become reproducible due to changes in their
build-dependencies:
75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90
[apertium-dan-nor](https://tracker.debian.org/pkg/apertium-dan-nor)
[apertium-swe-nor](https://tracker.debian.org/pkg/apertium-swe-nor)
[asterisk-prompt-fr-armelle](https://tracker.debian.org/pkg/asterisk-prompt-fr-armelle)
[blktrace](https://tracker.debian.org/pkg/blktrace)
[canl-c](https://tracker.debian.org/pkg/canl-c)
[code-saturne](https://tracker.debian.org/pkg/code-saturne)
[coinor-symphony](https://tracker.debian.org/pkg/coinor-symphony)
[dsc-statistics](https://tracker.debian.org/pkg/dsc-statistics)
[frobby](https://tracker.debian.org/pkg/frobby)
[libphp-jpgraph](https://tracker.debian.org/pkg/libphp-jpgraph)
[paje.app](https://tracker.debian.org/pkg/paje.app)
[proxycheck](https://tracker.debian.org/pkg/proxycheck)
[pybit](https://tracker.debian.org/pkg/pybit)
[spip](https://tracker.debian.org/pkg/spip)
[tircd](https://tracker.debian.org/pkg/tircd)
[xbs](https://tracker.debian.org/pkg/xbs)
91 92 93

The following 5 packages are new in Debian and appear to be reproducible so
far:
94 95 96 97 98
[golang-github-bowery-prompt](https://tracker.debian.org/pkg/golang-github-bowery-prompt)
[golang-github-pkg-errors](https://tracker.debian.org/pkg/golang-github-pkg-errors)
[golang-gopkg-dancannon-gorethink.v2](https://tracker.debian.org/pkg/golang-gopkg-dancannon-gorethink.v2)
[libtask-kensho-perl](https://tracker.debian.org/pkg/libtask-kensho-perl)
[sspace](https://tracker.debian.org/pkg/sspace)
99 100 101 102

The following packages had older versions which were reproducible, and
their latest versions are now reproducible again after being fixed:

103 104
 * [excellent-bifurcation](https://tracker.debian.org/pkg/excellent-bifurcation)/0.0.20071015-8 by Vincent Cheng, [#826427](https://bugs.debian.org/826427) by Reiner Herrmann.
 * [gnurobbo](https://tracker.debian.org/pkg/gnurobbo)/0.68+dfsg-2 by Stephen Kitt, [#826424](https://bugs.debian.org/826424) by Reiner Herrmann.
105 106 107

The following packages have become reproducible after being fixed:

108 109 110 111 112 113 114 115 116 117
 * [gdbm](https://tracker.debian.org/pkg/gdbm)/1.8.3-14 by Matthias Klose, [#774394](https://bugs.debian.org/774394) by Jérémy Bobbio.
 * [miceamaze](https://tracker.debian.org/pkg/miceamaze)/4.2.1-3 by Sarah COUDERT, [#825634](https://bugs.debian.org/825634) by Reiner Herrmann.
 * [netcdf](https://tracker.debian.org/pkg/netcdf)/1:4.4.1~rc2-1~exp3 by Bas Couwenberg.
 * [osmo-bts](https://tracker.debian.org/pkg/osmo-bts)/0.4.0-2 by Ruben Undheim.
 * [pd-hcs](https://tracker.debian.org/pkg/pd-hcs)/0.1-3 by IOhannes m zmölnig.
 * [pd-hid](https://tracker.debian.org/pkg/pd-hid)/0.7-2 by IOhannes m zmölnig.
 * [python-certbot](https://tracker.debian.org/pkg/python-certbot)/0.8.0-1 by Harlan Lieberman-Berg, [#824452](https://bugs.debian.org/824452) by Chris Lamb.
 * [python-csb](https://tracker.debian.org/pkg/python-csb)/1.2.3+dfsg-3 by Sascha Steinbiss.
 * [python-osprofiler](https://tracker.debian.org/pkg/python-osprofiler)/1.3.0-2 by Thomas Goirand.
 * [usb-modeswitch-data](https://tracker.debian.org/pkg/usb-modeswitch-data)/20160112-3 by Didier Raboud, [#826343](https://bugs.debian.org/826343) by intrigeri.
118 119 120

Some uploads have fixed some reproducibility issues, but not all of them:

121 122 123 124 125 126 127 128
 * [bzr](https://tracker.debian.org/pkg/bzr)/2.7.0-7 by Jelmer Vernooij.
 * [clanlib](https://tracker.debian.org/pkg/clanlib)/1.0~svn3827-5 by Stephen Kitt, [#790357](https://bugs.debian.org/790357) by Chris Lamb.
 * [dwarfutils](https://tracker.debian.org/pkg/dwarfutils)/20160507+git20160523.9086738-1 by Fabian Wolff.
 * [fakeroot](https://tracker.debian.org/pkg/fakeroot)/1.20.2-2 by Clint Adams, [#795861](https://bugs.debian.org/795861).
 * [fastqtl](https://tracker.debian.org/pkg/fastqtl)/2.184+dfsg-2 by Dylan Aïssi, [#826209](https://bugs.debian.org/826209) by Chris Lamb.
 * [gnuplot](https://tracker.debian.org/pkg/gnuplot)/5.0.3+dfsg3-3 by Anton Gladky.
 * [lazarus](https://tracker.debian.org/pkg/lazarus)/1.6+dfsg-3 by Paul Gevers.
 * [python-pygit2](https://tracker.debian.org/pkg/python-pygit2)/0.24.0-3 by Ondřej Nový.
129 130 131

Patches submitted that have not made their way to the archive yet:

132 133 134 135 136 137 138 139 140 141 142 143 144 145 146
 * [#806331](https://bugs.debian.org/806331) against [xz-utils](https://tracker.debian.org/pkg/xz-utils) by Ximin Luo: make the selected POSIX shell stable across build environments
 * [#806494](https://bugs.debian.org/806494) against [gnupg](https://tracker.debian.org/pkg/gnupg) by intrigeri: Make man pages not embed a build-time dependent timestamp
 * [#806945](https://bugs.debian.org/806945) against [bash](https://tracker.debian.org/pkg/bash) by Reiner Herrmann and Ximin Luo: Use the system man2html, and set PGRP_PIPE unconditionally.
 * [#825857](https://bugs.debian.org/825857) against [python-setuptools](https://tracker.debian.org/pkg/python-setuptools) by Anton Gladky: sort libs in native_libs.txt
 * [#826408](https://bugs.debian.org/826408) against [brainparty](https://tracker.debian.org/pkg/brainparty) by Reiner Herrmann: Sort object files for deterministic linking order
 * [#826416](https://bugs.debian.org/826416) against [blockout2](https://tracker.debian.org/pkg/blockout2) by Reiner Herrmann: Sort the list of source files
 * [#826418](https://bugs.debian.org/826418) against [xgalaga++](https://tracker.debian.org/pkg/xgalaga++) by Reiner Herrmann: Sort source files to get a deterministic linking order
 * [#826423](https://bugs.debian.org/826423) against [kraptor](https://tracker.debian.org/pkg/kraptor) by Reiner Herrmann: Sort source files for deterministic linking order
 * [#826431](https://bugs.debian.org/826431) against [traceroute](https://tracker.debian.org/pkg/traceroute) by Reiner Herrmann: Sort lists of libraries/source/object files
 * [#826544](https://bugs.debian.org/826544) against [doc-debian](https://tracker.debian.org/pkg/doc-debian) by intrigeri: make the created files stable regardless of the locale
 * [#826676](https://bugs.debian.org/826676) against [python-openstackclient](https://tracker.debian.org/pkg/python-openstackclient) by Chris Lamb: make the build reproducible
 * [#826677](https://bugs.debian.org/826677) against [cadencii](https://tracker.debian.org/pkg/cadencii) by Chris Lamb: make the build reproducible
 * [#826760](https://bugs.debian.org/826760) against [dctrl-tools](https://tracker.debian.org/pkg/dctrl-tools) by Reiner Herrmann: Sort object files for deterministic linking order
 * [#826951](https://bugs.debian.org/826951) against [slicot](https://tracker.debian.org/pkg/slicot) by Alexis Bienvenüe: please make the build reproducible (fileordering)
 * [#826982](https://bugs.debian.org/826982) against [hoichess](https://tracker.debian.org/pkg/hoichess) by Reiner Herrmann: Sort object files for deterministic linking order
147 148 149 150 151 152

Package reviews
---------------

68 reviews have been added, 19 have been updated and 28 have been removed in this week. New and updated issues:

153 154 155 156 157 158
 * [cryptographic_signature](https://tests.reproducible-builds.org/issues/unstable/cryptographic_signature_issue.html)
 * [timestamps_in_maven_version_files](https://tests.reproducible-builds.org/issues/unstable/timestamps_in_maven_version_files_issue.html)
 * [ftbfs_build-indep_not_build_on_some_archs](https://tests.reproducible-builds.org/issues/unstable/ftbfs_build-indep_not_build_on_some_archs_issue.html)
 * [timestamps_added_by_xbean_spring](https://tests.reproducible-builds.org/issues/unstable/timestamps_added_by_xbean_spring_issue.html)
 * [timestamps_in_maven_metadata_local_xml_files](https://tests.reproducible-builds.org/issues/unstable/timestamps_in_maven_metadata_local_xml_files_issue.html)
 * [timestamps_in_documentation_generated_by_asciidoctor](https://tests.reproducible-builds.org/issues/unstable/timestamps_in_documentation_generated_by_asciidoctor_issue.html)
159 160 161 162 163 164

26 FTBFS bugs have been reported by Chris Lamb, 1 by Santiago Vila and 1 by Sascha Steinbiss.

diffoscope development
----------------------

165
- Mattia Rizzolo uploaded [diffoscope](https://tracker.debian.org/pkg/diffoscope)/54 to jessie-backports.
166 167 168 169

strip-nondeterminism development
--------------------------------

170 171 172
- Mattia uploaded [strip-nondeterminism](https://tracker.debian.org/pkg/strip-nondeterminism)/0.018-1 to jessie-backports, to
  support a [debhelper](https://tracker.debian.org/pkg/debhelper) backport.
- Andrew Ayer uploaded [strip-nondeterminism](https://tracker.debian.org/pkg/strip-nondeterminism)/0.018-2 fixing [#826700](https://bugs.debian.org/826700), a packaging improvement for Multi-Arch to ease cross-build
173
  situations.
174
- 2 days later Andrew released [strip-nondeterminism](https://tracker.debian.org/pkg/strip-nondeterminism)/0.019; now
175
  strip-nondeterminism is able to:
176
  - recursively normalize JAR files embedded within JAR files ([#823917](https://bugs.debian.org/823917))
177 178 179 180 181
  - clamp the timestamp, the same way tar >=1.28-2.2 can (for now available only  for gzip archives)

disorderfs development
----------------------

182
- Andrew Ayer released [disorderfs](https://tracker.debian.org/pkg/disorderfs)/0.4.3, fixing a issue with umask handling ([#826891](https://bugs.debian.org/826891))
183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206

tests.reproducible-builds.org
-----------------------

- Valerie Young namespaced the Debian-specific pages to [/debian/
  namespace](https://tests.reproducible-builds.org/debian), with redirects to
  for the previous URLs.
- Holger Levsen improved the reliability of build jobs: the availability of
  both build nodes (for a given build) is now being tested when a build job is
  started, to better cope when one of the 25 build nodes go down for some reason.
- Ximin Luo improved the [index of identified
  issues](https://tests.reproducible-builds.org/debian/index_issues.html) to
  include the total popcon scores of each issue, which is now also used for
  sorting that page.

Misc.
-----

Steven Chamberlain [submitted a patch to FreeBSD's
makefs](https://lists.freebsd.org/pipermail/freebsd-hackers/2016-June/049571.html)
to allow reproducible builds of the kfreebsd installer.

Ed Maste [committed a patch to FreeBSD's
binutils](https://svnweb.freebsd.org/ports?view=revision&revision=416639) to
Georg Faerber's avatar
Georg Faerber committed
207
enable deterministic archives by default in GNU ar.
208 209 210 211

Helmut Grohne
[experimented](https://anonscm.debian.org/cgit/users/helmutg/rebootstrap.git/commit/?id=12d820314bcb459131eebc55e22a48e545acb0b5)
[with](https://anonscm.debian.org/cgit/users/helmutg/rebootstrap.git/commit/?id=39277ab9347848073bcd310f98026177eee2ea66)
212
cross+native reproductions of [dash](https://tracker.debian.org/pkg/dash) with some success, using
213 214 215 216
[rebootstrap](https://wiki.debian.org/HelmutGrohne/rebootstrap).

This week's edition was written by Ximin Luo, Chris Lamb, Holger Levsen, Mattia
Rizzolo and reviewed by a bunch of Reproducible builds folks on IRC.