Loading tools.md +48 −42 Original line number Diff line number Diff line Loading @@ -20,19 +20,6 @@ order: 30 ## Tools to compare build artifacts and/or detect nondeterminism #### disorderfs Problems with [unstable order of inputs](/docs/stable-inputs/) or other variations introduced by filesystems can sometimes be hard to track down. `disorderfs` is an overlay FUSE filesystem that deliberately introduces non-determinism into filesystem metadata. For example, it can randomize the order in which directory entries are read. <a href="https://salsa.debian.org/reproducible-builds/disorderfs" class="btn btn-outline-primary btn-sm">Git</a> <a href="https://salsa.debian.org/reproducible-builds/disorderfs/merge_requests" class="btn btn-outline-primary btn-sm">Merge requests</a> <a href="https://packages.debian.org/sid/disorderfs" class="btn btn-outline-primary btn-sm">Debian package</a> <a href="https://archlinux.org/packages/extra/x86_64/disorderfs" class="btn btn-outline-primary btn-sm">Arch Linux package</a> #### diffoscope [diffoscope](https://diffoscope.org/) will try to get to the bottom of what Loading Loading @@ -76,6 +63,19 @@ changing the source code, changed the generated binaries. <a href="https://packages.debian.org/sid/reprotest" class="btn btn-outline-primary btn-sm">Debian package</a> <a href="https://archlinux.org/packages/extra/any/reprotest" class="btn btn-outline-primary btn-sm">Arch Linux package</a> #### disorderfs Problems with [unstable order of inputs](/docs/stable-inputs/) or other variations introduced by filesystems can sometimes be hard to track down. `disorderfs` is an overlay FUSE filesystem that deliberately introduces non-determinism into filesystem metadata. For example, it can randomize the order in which directory entries are read. <a href="https://salsa.debian.org/reproducible-builds/disorderfs" class="btn btn-outline-primary btn-sm">Git</a> <a href="https://salsa.debian.org/reproducible-builds/disorderfs/merge_requests" class="btn btn-outline-primary btn-sm">Merge requests</a> <a href="https://packages.debian.org/sid/disorderfs" class="btn btn-outline-primary btn-sm">Debian package</a> <a href="https://archlinux.org/packages/extra/x86_64/disorderfs" class="btn btn-outline-primary btn-sm">Arch Linux package</a> #### diffoci `diffoci` compares Docker and OCI container images for helping reproducible builds. Loading @@ -84,35 +84,18 @@ changing the source code, changed the generated binaries. <a href="https://github.com/reproducible-containers/diffoci/issues" class="btn btn-outline-primary btn-sm">Issues</a> <a href="https://github.com/reproducible-containers/diffoci/pulls" class="btn btn-outline-primary btn-sm">Merge requests</a> #### reproducible-apk-tools #### apksigcopier `apksigcopier` is a tool that enables using an android APK signature as a build input, making it possible to create a reproducible build from the source code without having access to the private key used to create the signature. It can also be used to verify that two APKs with different signatures are otherwise identical. `reproducible-apk-tools` is a collection of scripts to help make APKs reproducible, or find out why they are not. <a href="https://github.com/obfusk/apksigcopier" class="btn btn-outline-primary btn-sm">Git</a> <a href="https://github.com/obfusk/apksigcopier/issues" class="btn btn-outline-primary btn-sm">Issues</a> <a href="https://github.com/obfusk/apksigcopier/pulls" class="btn btn-outline-primary btn-sm">Merge requests</a> <a href="https://github.com/obfusk/reproducible-apk-tools" class="btn btn-outline-primary btn-sm">Git</a> <a href="https://github.com/obfusk/reproducible-apk-tools/issues" class="btn btn-outline-primary btn-sm">Issues</a> <a href="https://github.com/obfusk/reproducible-apk-tools/issuepullss" class="btn btn-outline-primary btn-sm">Merge requests</a> ## Tools to make builds reproducible (by removing nondeterminism) #### disorderfs Problems with [unstable order of inputs](/docs/stable-inputs/) or other variations introduced by filesystems can sometimes be hard to track down. `disorderfs` is an overlay FUSE filesystem that deliberately introduces non-determinism into filesystem metadata. For example, it can randomize the order in which directory entries are read. <a href="https://salsa.debian.org/reproducible-builds/disorderfs" class="btn btn-outline-primary btn-sm">Git</a> <a href="https://salsa.debian.org/reproducible-builds/disorderfs/merge_requests" class="btn btn-outline-primary btn-sm">Merge requests</a> <a href="https://packages.debian.org/sid/disorderfs" class="btn btn-outline-primary btn-sm">Debian package</a> <a href="https://archlinux.org/packages/extra/x86_64/disorderfs" class="btn btn-outline-primary btn-sm">Arch Linux package</a> #### strip-nondeterminism Some tools used in build systems might introduce non-determinism in ways Loading @@ -127,6 +110,19 @@ extensibility in mind. <a href="https://packages.debian.org/sid/strip-nondeterminism" class="btn btn-outline-primary btn-sm">Debian package</a> <a href="https://archlinux.org/packages/extra/any/strip-nondeterminism" class="btn btn-outline-primary btn-sm">Arch Linux package</a> #### disorderfs Problems with [unstable order of inputs](/docs/stable-inputs/) or other variations introduced by filesystems can sometimes be hard to track down. `disorderfs` is an overlay FUSE filesystem that deliberately introduces non-determinism into filesystem metadata. For example, it can randomize the order in which directory entries are read. <a href="https://salsa.debian.org/reproducible-builds/disorderfs" class="btn btn-outline-primary btn-sm">Git</a> <a href="https://salsa.debian.org/reproducible-builds/disorderfs/merge_requests" class="btn btn-outline-primary btn-sm">Merge requests</a> <a href="https://packages.debian.org/sid/disorderfs" class="btn btn-outline-primary btn-sm">Debian package</a> <a href="https://archlinux.org/packages/extra/x86_64/disorderfs" class="btn btn-outline-primary btn-sm">Arch Linux package</a> #### Reproducible Build Maven Plugin This Maven plugin tries to strip "non reproducible" data from the generatedartifacts. Loading Loading @@ -155,6 +151,18 @@ APKs reproducible, or find out why they are not. <a href="https://github.com/obfusk/reproducible-apk-tools/issues" class="btn btn-outline-primary btn-sm">Issues</a> <a href="https://github.com/obfusk/reproducible-apk-tools/issuepullss" class="btn btn-outline-primary btn-sm">Merge requests</a> #### apksigcopier `apksigcopier` is a tool that enables using an android APK signature as a build input, making it possible to create a reproducible build from the source code without having access to the private key used to create the signature. It can also be used to verify that two APKs with different signatures are otherwise identical. <a href="https://github.com/obfusk/apksigcopier" class="btn btn-outline-primary btn-sm">Git</a> <a href="https://github.com/obfusk/apksigcopier/issues" class="btn btn-outline-primary btn-sm">Issues</a> <a href="https://github.com/obfusk/apksigcopier/pulls" class="btn btn-outline-primary btn-sm">Merge requests</a> ## Tools for rebuilding Loading @@ -162,7 +170,7 @@ APKs reproducible, or find out why they are not. #### rebuilderd Independent verification system of binary packages. rebuilderd monitors the Independent verification system of binary packages. `rebuilderd` monitors the package repository of a linux distribution and uses rebuilder backends like archlinux-repro to verify the provided binary packages can be reproduced from the given source code. Loading Loading @@ -251,16 +259,15 @@ information. <a href="https://github.com/fepitre/rpmreproduce/issues" class="btn btn-outline-primary btn-sm">Issues</a> <a href="https://github.com/fepitre/rpmreproduce/pulls" class="btn btn-outline-primary btn-sm">Merge requests</a> #### orb: check opam package reproducibility This tool can check if an opam package build is reproductible. It has two subcommands: build and rebuild. The orb build conducts a build of an opam package, and collects `orb build` conducts a build of an opam package, and collects the build result (and hashes thereof) and the build input. The orb rebuild takes this data as input and conducts a second build with `orb rebuild` takes this data as input and conducts a second build with the same environment, and compares that the hashes of the produced binaries are identical. Loading Loading @@ -305,7 +312,6 @@ maintainer and currently installed packages on the system. <a href="https://gitlab.archlinux.org/archlinux/arch-repro-status/-/merge_requests" class="btn btn-outline-primary btn-sm">Merge requests</a> <a href="https://archlinux.org/packages/extra/x86_64/arch-repro-status/" class="btn btn-outline-primary btn-sm">Arch Linux package</a> #### Builder-web - a web frontend for reproducible builds (robur) `Builder-web` takes in submissions of builds, typically from builder, Loading Loading
tools.md +48 −42 Original line number Diff line number Diff line Loading @@ -20,19 +20,6 @@ order: 30 ## Tools to compare build artifacts and/or detect nondeterminism #### disorderfs Problems with [unstable order of inputs](/docs/stable-inputs/) or other variations introduced by filesystems can sometimes be hard to track down. `disorderfs` is an overlay FUSE filesystem that deliberately introduces non-determinism into filesystem metadata. For example, it can randomize the order in which directory entries are read. <a href="https://salsa.debian.org/reproducible-builds/disorderfs" class="btn btn-outline-primary btn-sm">Git</a> <a href="https://salsa.debian.org/reproducible-builds/disorderfs/merge_requests" class="btn btn-outline-primary btn-sm">Merge requests</a> <a href="https://packages.debian.org/sid/disorderfs" class="btn btn-outline-primary btn-sm">Debian package</a> <a href="https://archlinux.org/packages/extra/x86_64/disorderfs" class="btn btn-outline-primary btn-sm">Arch Linux package</a> #### diffoscope [diffoscope](https://diffoscope.org/) will try to get to the bottom of what Loading Loading @@ -76,6 +63,19 @@ changing the source code, changed the generated binaries. <a href="https://packages.debian.org/sid/reprotest" class="btn btn-outline-primary btn-sm">Debian package</a> <a href="https://archlinux.org/packages/extra/any/reprotest" class="btn btn-outline-primary btn-sm">Arch Linux package</a> #### disorderfs Problems with [unstable order of inputs](/docs/stable-inputs/) or other variations introduced by filesystems can sometimes be hard to track down. `disorderfs` is an overlay FUSE filesystem that deliberately introduces non-determinism into filesystem metadata. For example, it can randomize the order in which directory entries are read. <a href="https://salsa.debian.org/reproducible-builds/disorderfs" class="btn btn-outline-primary btn-sm">Git</a> <a href="https://salsa.debian.org/reproducible-builds/disorderfs/merge_requests" class="btn btn-outline-primary btn-sm">Merge requests</a> <a href="https://packages.debian.org/sid/disorderfs" class="btn btn-outline-primary btn-sm">Debian package</a> <a href="https://archlinux.org/packages/extra/x86_64/disorderfs" class="btn btn-outline-primary btn-sm">Arch Linux package</a> #### diffoci `diffoci` compares Docker and OCI container images for helping reproducible builds. Loading @@ -84,35 +84,18 @@ changing the source code, changed the generated binaries. <a href="https://github.com/reproducible-containers/diffoci/issues" class="btn btn-outline-primary btn-sm">Issues</a> <a href="https://github.com/reproducible-containers/diffoci/pulls" class="btn btn-outline-primary btn-sm">Merge requests</a> #### reproducible-apk-tools #### apksigcopier `apksigcopier` is a tool that enables using an android APK signature as a build input, making it possible to create a reproducible build from the source code without having access to the private key used to create the signature. It can also be used to verify that two APKs with different signatures are otherwise identical. `reproducible-apk-tools` is a collection of scripts to help make APKs reproducible, or find out why they are not. <a href="https://github.com/obfusk/apksigcopier" class="btn btn-outline-primary btn-sm">Git</a> <a href="https://github.com/obfusk/apksigcopier/issues" class="btn btn-outline-primary btn-sm">Issues</a> <a href="https://github.com/obfusk/apksigcopier/pulls" class="btn btn-outline-primary btn-sm">Merge requests</a> <a href="https://github.com/obfusk/reproducible-apk-tools" class="btn btn-outline-primary btn-sm">Git</a> <a href="https://github.com/obfusk/reproducible-apk-tools/issues" class="btn btn-outline-primary btn-sm">Issues</a> <a href="https://github.com/obfusk/reproducible-apk-tools/issuepullss" class="btn btn-outline-primary btn-sm">Merge requests</a> ## Tools to make builds reproducible (by removing nondeterminism) #### disorderfs Problems with [unstable order of inputs](/docs/stable-inputs/) or other variations introduced by filesystems can sometimes be hard to track down. `disorderfs` is an overlay FUSE filesystem that deliberately introduces non-determinism into filesystem metadata. For example, it can randomize the order in which directory entries are read. <a href="https://salsa.debian.org/reproducible-builds/disorderfs" class="btn btn-outline-primary btn-sm">Git</a> <a href="https://salsa.debian.org/reproducible-builds/disorderfs/merge_requests" class="btn btn-outline-primary btn-sm">Merge requests</a> <a href="https://packages.debian.org/sid/disorderfs" class="btn btn-outline-primary btn-sm">Debian package</a> <a href="https://archlinux.org/packages/extra/x86_64/disorderfs" class="btn btn-outline-primary btn-sm">Arch Linux package</a> #### strip-nondeterminism Some tools used in build systems might introduce non-determinism in ways Loading @@ -127,6 +110,19 @@ extensibility in mind. <a href="https://packages.debian.org/sid/strip-nondeterminism" class="btn btn-outline-primary btn-sm">Debian package</a> <a href="https://archlinux.org/packages/extra/any/strip-nondeterminism" class="btn btn-outline-primary btn-sm">Arch Linux package</a> #### disorderfs Problems with [unstable order of inputs](/docs/stable-inputs/) or other variations introduced by filesystems can sometimes be hard to track down. `disorderfs` is an overlay FUSE filesystem that deliberately introduces non-determinism into filesystem metadata. For example, it can randomize the order in which directory entries are read. <a href="https://salsa.debian.org/reproducible-builds/disorderfs" class="btn btn-outline-primary btn-sm">Git</a> <a href="https://salsa.debian.org/reproducible-builds/disorderfs/merge_requests" class="btn btn-outline-primary btn-sm">Merge requests</a> <a href="https://packages.debian.org/sid/disorderfs" class="btn btn-outline-primary btn-sm">Debian package</a> <a href="https://archlinux.org/packages/extra/x86_64/disorderfs" class="btn btn-outline-primary btn-sm">Arch Linux package</a> #### Reproducible Build Maven Plugin This Maven plugin tries to strip "non reproducible" data from the generatedartifacts. Loading Loading @@ -155,6 +151,18 @@ APKs reproducible, or find out why they are not. <a href="https://github.com/obfusk/reproducible-apk-tools/issues" class="btn btn-outline-primary btn-sm">Issues</a> <a href="https://github.com/obfusk/reproducible-apk-tools/issuepullss" class="btn btn-outline-primary btn-sm">Merge requests</a> #### apksigcopier `apksigcopier` is a tool that enables using an android APK signature as a build input, making it possible to create a reproducible build from the source code without having access to the private key used to create the signature. It can also be used to verify that two APKs with different signatures are otherwise identical. <a href="https://github.com/obfusk/apksigcopier" class="btn btn-outline-primary btn-sm">Git</a> <a href="https://github.com/obfusk/apksigcopier/issues" class="btn btn-outline-primary btn-sm">Issues</a> <a href="https://github.com/obfusk/apksigcopier/pulls" class="btn btn-outline-primary btn-sm">Merge requests</a> ## Tools for rebuilding Loading @@ -162,7 +170,7 @@ APKs reproducible, or find out why they are not. #### rebuilderd Independent verification system of binary packages. rebuilderd monitors the Independent verification system of binary packages. `rebuilderd` monitors the package repository of a linux distribution and uses rebuilder backends like archlinux-repro to verify the provided binary packages can be reproduced from the given source code. Loading Loading @@ -251,16 +259,15 @@ information. <a href="https://github.com/fepitre/rpmreproduce/issues" class="btn btn-outline-primary btn-sm">Issues</a> <a href="https://github.com/fepitre/rpmreproduce/pulls" class="btn btn-outline-primary btn-sm">Merge requests</a> #### orb: check opam package reproducibility This tool can check if an opam package build is reproductible. It has two subcommands: build and rebuild. The orb build conducts a build of an opam package, and collects `orb build` conducts a build of an opam package, and collects the build result (and hashes thereof) and the build input. The orb rebuild takes this data as input and conducts a second build with `orb rebuild` takes this data as input and conducts a second build with the same environment, and compares that the hashes of the produced binaries are identical. Loading Loading @@ -305,7 +312,6 @@ maintainer and currently installed packages on the system. <a href="https://gitlab.archlinux.org/archlinux/arch-repro-status/-/merge_requests" class="btn btn-outline-primary btn-sm">Merge requests</a> <a href="https://archlinux.org/packages/extra/x86_64/arch-repro-status/" class="btn btn-outline-primary btn-sm">Arch Linux package</a> #### Builder-web - a web frontend for reproducible builds (robur) `Builder-web` takes in submissions of builds, typically from builder, Loading
