[Git][reproducible-builds/reproducible-website][master] 2 commits: 2019-12: Drop unnecessary month_name.
Chris Lamb
gitlab at salsa.debian.org
Mon Dec 9 16:28:46 UTC 2019
Chris Lamb pushed to branch master at Reproducible Builds / reproducible-website
Commits:
b1a2830b by Chris Lamb at 2019-12-09T16:27:12Z
2019-12: Drop unnecessary month_name.
- - - - -
48c28267 by Chris Lamb at 2019-12-09T16:27:22Z
2019-11: Initial draft.
- - - - -
19 changed files:
- _reports/2019-11.md
- _reports/2019-12.md
- + images/reports/2019-11/alpine.png
- + images/reports/2019-11/archlinux.png
- + images/reports/2019-11/coreboot.png
- + images/reports/2019-11/debian.png
- + images/reports/2019-11/diffoscope.svg
- + images/reports/2019-11/gnu.png
- + images/reports/2019-11/guix.png
- + images/reports/2019-11/maven.png
- + images/reports/2019-11/ocaml.png
- + images/reports/2019-11/opensuse-graph.png
- + images/reports/2019-11/opensuse.png
- + images/reports/2019-11/openwrt.png
- + images/reports/2019-11/reproducible-builds.png
- + images/reports/2019-11/summit.jpg
- + images/reports/2019-11/testframework.png
- + images/reports/2019-11/themanifest.jpg
- + images/reports/2019-11/website.png
Changes:
=====================================
_reports/2019-11.md
=====================================
@@ -2,20 +2,110 @@
layout: report
year: "2019"
month: "11"
-month_name: "November"
-title: "Reproducible builds in November 2019"
+title: "Reproducible Builds in November 2019"
draft: true
---
-**Welcome to the November 2019 report from the [Reproducible Builds]({{ "/" | prepend: site.baseurl }}) project. 👌**
+**Welcome to the November 2019 report from the [Reproducible Builds](https://reproducible-builds.org) project!**
{: .lead}
-[![]({{ "/images/reports/2019-11/reproducible-builds.png#right" | prepend: site.baseurl }})]({{ "/" | prepend: site.baseurl }})
+[![]({{ "/images/reports/2019-11/reproducible-builds.png#right" | prepend: site.baseurl }})](https://reproducible-builds.org/)
-In our monthly reports we attempt outline the most important things that we have been up to recently. As a reminder on what our little project is all about, whilst anyone can inspect the source code of free software for malicious changes most software is distributed to end users or servers as precompiled binaries. Reproducible builds tries to ensure that no changes have been made during these compilation processes by promising identical results are always generated from a given source, allowing multiple third-parties to come to a consensus on whether a build was compromised.
+In these reports we outline the most important things that we have been up over the past month. As a quick recap, whilst anyone can inspect the source code of free software for malicious flaws, almost all software is distributed to end users as pre-compiled binaries.
-In this month's report, we will cover:
-* FIXME
+The motivation behind the reproducible builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised.
+
+In this month's report, we cover:
+
+* **Media coverage and events** — *Enter the Reproducibility Challenge, etc.*
+* **Upstream news** — *OCaml, Mes, Maven, etc.*
+* **Distribution work** — *The latest reports from Arch, Debian and openSUSE, etc.*
+* **Software development** — *A Christmas bonanza of patches and work on diffoscope, etc.*
+* **Contributing** — *How to get in touch&hellip*
+
+If you are interested in contributing to our project, please visit our [*Contribute*]({{ "/contribute/" | prepend: site.baseurl }}) page on our website.
+
+---
+
+## Media coverage and events
+
+***We held our [fifth annual Reproducible Builds summit]({{ "/events/Marrakesh2019/" | prepend: site.baseurl }}) between the 1st and 8th December in Marrakesh, Morocco. A full, in-depth report will be posted next month…***
+
+On November 16th, Vagrant Cascadian presented [*There and Back Again, Reproducibly*](https://osem.seagl.org/conferences/seagl2019/program/proposals/671) at the [SeaGL](https://seagl.org) in Seattle, Washington.
+
+[![]({{ "/images/reports/2019-11/themanifest.jpg#right" | prepend: site.baseurl }})](https://manifest.fm/14)
+
+Chris Lamb was featured on [The Manifest](https://manifest.fm) package management podcast in an episode called [*Reproducible Builds project and Debian package management*](https://manifest.fm/14).
+
+[ReScience C](http://rescience.github.io/) is an open-access journal that targets computational research and encourages the explicit replication of already published research. This month they announced their [*Ten Years Reproducibility Challenge*](https://rescience.github.io/ten-years/) which promotes the idea that old code (in this instance, a "scientific article [published] before January 1st 2010") should also run on modern hardware and software in order to check one can obtain the same scientific results in the future.
+
+---
+
+## Upstream news
+
+Mike Hommey [pushed a change to Mozilla build system](https://hg.mozilla.org/integration/autoland/rev/cd6b79c74b23) to add and print an error message when differences are found between builds as requested in [bug 1597903](https://bugzilla.mozilla.org/show_bug.cgi?id=1597903).
+
+[![]({{ "/images/reports/2019-11/ocaml.png#right" | prepend: site.baseurl }})](https://ocaml.org/)
+
+There was fresh activity on an old pull request for the [OCaml](https://ocaml.org/) programming language regarding the usage and adoption of the [`BUILD_PATH_PREFIX_MAP` environment variable](https://reproducible-builds.org/specs/build-path-prefix-map/) that is used to ensure that software packages do not embed build-time paths into generated files. On [the pull request](https://github.com/ocaml/ocaml/pull/1515) in question [Gabriel Scherer](http://gallium.inria.fr/~scherer/) was kind [to provide many helpful examples on how to use the rewrite rules](https://github.com/ocaml/ocaml/pull/1515#issuecomment-559035723).
+
+Jan Nieuwenhuizen [announced the release of GNU Mes 0.21](https://lists.reproducible-builds.org/pipermail/rb-general/2019-November/001725.html) and Jeremiah Orians [announced](https://lists.reproducible-builds.org/pipermail/rb-general/2019-November/001711.html) the release of [mescc-tools-seed](https://github.com/oriansj/mescc-tools-seed) version 1.1:
+
+> Capable of bootstrapping from a simple hex assembler all the way to a cross-platform C compiler Work is still ongoing [to] result in a full bootstrap from a 357 byte bootstrap binary all the way to GCC.
+
+[![]({{ "/images/reports/2019-11/maven.png#right" | prepend: site.baseurl }})](https://maven.apache.org/)
+
+[Hervé Boutemy](http://people.apache.org/~hboutemy/) announced the release of three base [Apache Maven](https://maven.apache.org/) plugins (source, `.jar`, and assembly) to get reproducible Builds as a direct output from this build system. For more information, please see the ["Configuring for Reproducible Builds"](https://maven.apache.org/guides/mini/guide-reproducible-builds.html) section of the documentation.
+
+Eli Schwartz reported a bug against the [GNU groff](https://www.gnu.org/software/groff/) typesetting sytem for incomplete [`SOURCE_DATE_EPOCH`](https://reproducible-builds.org/specs/source-date-epoch/) environment variable support [due to its output files embedding the timezone](https://savannah.gnu.org/bugs/?57218).
+
+---
+
+### Distribution work
+
+#### Arch Linux
+
+[![]({{ "/images/reports/2019-11/archlinux.png#right" | prepend: site.baseurl }})](https://www.archlinux.org/)
+
+A [slight but temporary decline in the reproducibility status](https://tests.reproducible-builds.org/archlinux/archlinux.png) was determined to be due to a bug in the continuous integration framework where one build was building with `--nocheck` whilst the other did, resulting in the test dependencies being installed on one build. This led to differences in the `BUILDINFO` file which records the build dependencies.
+
+Morten Linderud (*Foxboron*) [wrote a blog post](https://linderud.dev/blog/reproducible-arch-linux-packages/) on the progress of reproducible builds for Arch packages, including how to reproduce packages and a roadmap of future of work.
+
+A lot of work has been put into getting the `[core]` more reproducible; [every package has been rebuilt](https://lists.archlinux.org/pipermail/arch-dev-public/2019-November/029721.html) with a new version of [pacman](https://wiki.archlinux.org/index.php/pacman) which resolves an issue with storing the package size. Build failures and download issues have also been resolved which have lead to an increase of reproducible packages in the [Arch Linux continuous integration setup](https://tests.reproducible-builds.org/archlinux/archlinux.html).
+
+The standard Arch Linux development tools package (`devtools`) now contains a new `makerepropkg` tool which can reproduce a package from the Arch repositories providing a `PKGBUILD` exists in the current working directory.
+
+#### openSUSE
+
+[![]({{ "/images/reports/2019-11/opensuse.png#right" | prepend: site.baseurl }})](https://www.opensuse.org/)
+
+Bernhard M. Wiedemann posted a [summary of openSUSE updates for 2019](https://lists.reproducible-builds.org/pipermail/rb-general/2019-November/001722.html) including `rpm`, a [high level openSUSE status](https://bugzilla.opensuse.org/show_bug.cgi?id=1133809) and fixing [problems with `.pyc` files](https://bugzilla.opensuse.org/show_bug.cgi?id=1094323) which is also relevant to Arch Linux.
+
+The report also summarises the current "total" reproducibility status:
+
+[![]({{ "/images/reports/2019-11/opensuse-graph.png#center" | prepend: site.baseurl }})](http://rb.zq1.de/compare.factory/graph.png)
+
+In addition to this, Bernhard also published his [monthly Reproducible Builds status update](https://lists.opensuse.org/opensuse-factory/2019-11/msg00370.html).
+
+#### Debian
+
+[![]({{ "/images/reports/2019-11/debian.png#right" | prepend: site.baseurl }})](https://debian.org/)
+
+[Thorsten Glaser](https://www.mirbsd.org/) [filed a bug against the `debhelper` packaging library](https://bugs.debian.org/944691) to request that it sets and exports a [`umask`](https://en.wikipedia.org/wiki/Umask) of `022` for all operations as a possible "harmonisation potential" — a varying `umask` can result in unreproducible packages as the file permissions on the build system can be embedded into archives generated by the build system.
+
+Chris Lamb categorised a large number of packages and issues in the Reproducible Builds "[notes](https://salsa.debian.org/reproducible-builds/reproducible-notes/activity)" repository, including adding a new `ocaml_dune_captures_build_path` toolchain issue [[...](https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/c12c8853)].
+
+Vagrant Cascadian filed a big against the [Lintian](https://lintian.debian.org/) Debian package static analyser to request that it [checks for missing and/or unsigned `.buildinfo` files](https://bugs.debian.org/944707). He also [uploaded the latest version](https://tracker.debian.org/news/1080851/accepted-mes-020-1-source-amd64-into-experimental-experimental/) of [GNU Mes](https://www.gnu.org/software/mes/) to the *unstable* distribution.
+
+#### Other
+
+[![]({{ "/images/reports/2019-11/alpine.png#right" | prepend: site.baseurl }})](https://alpinelinux.org/)
+
+Nationael Copa ([@n_copa](https://twitter.com/n_copa)) posted on Twitter that he was was [finally able to make a fully reproducible package](https://twitter.com/n_copa/status/1192447768855482369)) for the [Alpine Linux](https://alpinelinux.org/).
+
+The [NixOS](https://nixos.org/) distribution announced that they [plan to run a Christmas Hackathon](https://www.meetup.com/NixOS-London/events/266848767) hosted by [Smarkets](https://smarkets.com/) in London, England on 9th December.
+
+---
## Software development
@@ -24,110 +114,174 @@ In this month's report, we will cover:
The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where appropriate. This month, we wrote a large number of such patches, including:
* Arnout Engelen:
- * [`OpenSC`](https://github.com/OpenSC/OpenSC/pull/1839) (generate consistent docbook id's)
+ * [`OpenSC`](https://github.com/OpenSC/OpenSC/pull/1839) (generate consistent [DocBook](https://docbook.org) identifiers)
* Bernhard M. Wiedemann:
- * [`python-oslo.reports`](https://review.opendev.org/693327) (drop unneccesary files with randomness)
- * [`perl-HTTP-Cookies`](https://github.com/libwww-perl/HTTP-Cookies/pull/56) (fix FTBFS-2025)
- * [`sql-parser`](https://github.com/hyrise/sql-parser/pull/133) (sort find/readdir)
- * [`maven-plugin-bundle`](https://github.com/apache/felix/pull/209) (java date)
- * [`vim`](https://bugzilla.opensuse.org/show_bug.cgi?id=1157623) (report FTBFS-j1)
- * [`pocl`](https://github.com/pocl/pocl/issues/793) (report compile-time CPU-detection)
- * [`lib3270`](https://github.com/PerryWerneck/lib3270/pull/3) (merged, date)
+
+ * [`abseil-cpp`](https://build.opensuse.org/request/show/750468) (sort the output of `find`/`readdir(2)`)
* [`afl`](https://github.com/vanhauser-thc/AFLplusplus/pull/122) (date)
- * [`buzztrax`](https://github.com/Buzztrax/buzztrax/issues/89) (report parallelism-nondeterminism issue from gtk-doc)
- * Various updates to rpm:
- * [`1`](https://github.com/rpm-software-management/rpm/pull/931) (keep at least one changelog entry to set `SOURCE_DATE_EPOCH`)
- * [`2`](https://github.com/rpm-software-management/rpm/pull/933) (regression fix that rpm-4.15 can override Build Date header again)
- * [`3`](https://github.com/rpm-software-management/rpm/pull/936) (sort to avoid ordering issues from parallel header generation)
- * [`4`](https://github.com/rpm-software-management/rpm/pull/944) (a cleaner solution for #3 above)
+ * [`brp-check-suse`](https://github.com/openSUSE/brp-check-suse/pull/29) (to strip [link-time optimisation (LTO)](https://en.wikipedia.org/wiki/Interprocedural_optimization) data from `.o` object files)
+ * [`buzztrax`](https://github.com/Buzztrax/buzztrax/issues/89) (report a parallelism/nondeterminism issue from [GTK-Doc](https://www.gtk.org/gtk-doc/))
+ * [`cardpeek`](https://build.opensuse.org/request/show/746648) (fix a previous patch)
+ * [`cecilia`](https://build.opensuse.org/request/show/750463) (strip date and time in a `.png` image file)
+ * [`lib3270`](https://github.com/PerryWerneck/lib3270/pull/3) (merged; date)
+ * [`maven-plugin-bundle`](https://github.com/apache/felix/pull/209) (fix a Java date)
+ * [`nulloy`](https://build.opensuse.org/request/show/746033) (`.zip` issue, [already filed upstream](https://github.com/nulloy/nulloy/pull/149))
+ * [`opencensus-cpp`](https://build.opensuse.org/request/show/751817) (sort the result of `find`/`readdir(2)`)
+ * [`OpenSC`](https://github.com/OpenSC/OpenSC/pull/1839) (generate consistent [DocBook](https://docbook.org) identifiers)
+ * [`pcc`](https://build.opensuse.org/request/show/745529) (fix a build failure from [LTO](https://en.wikipedia.org/wiki/Interprocedural_optimization) in `.a` archive files)
+ * [`perl-HTTP-Cookies`](https://github.com/libwww-perl/HTTP-Cookies/pull/56) (fix a build failure in 2025)
+ * [`pocl`](https://github.com/pocl/pocl/issues/793) (report compile-time CPU detection)
+ * [`python-oslo.reports`](https://review.opendev.org/693327) (drop unneccesary files with randomness)
+ * [`sql-parser`](https://github.com/hyrise/sql-parser/pull/134) (sort `find`/`readdir(2)`)
+ * [`vim`](https://bugzilla.opensuse.org/show_bug.cgi?id=1157623) (report a build failure when built without parallelism)
-* Chris Lamb:
- * [`genpy`](https://github.com/ros/genpy/pull/110) (sort python set)
- * [`isbg`](https://github.com/isbg/isbg/pull/139) (user)
- * [`snakemake`](https://github.com/snakemake/snakemake/pull/80) (build path)
- * [`splitpatch`](https://github.com/jaalto/splitpatch/pull/8) (fixup makefile date)
- * [`sybil`](https://github.com/cjw296/sybil/pull/18) (python date)
+ * Various updates to the [RPM package manager](https://rpm.org/):
+ * [#931](https://github.com/rpm-software-management/rpm/pull/931) — Keep at least one changelog entry to set [`SOURCE_DATE_EPOCH`](https://reproducible-builds.org/specs/source-date-epoch/).
+ * [#933](https://github.com/rpm-software-management/rpm/pull/933) — Regression fix so we can override the `Build Date` header again.
+ * [#936](https://github.com/rpm-software-management/rpm/pull/936) — Sort to avoid ordering issues from parallel header generation.
+ * [#944](https://github.com/rpm-software-management/rpm/pull/944) — Provide a cleaner solution for bug [#936](https://github.com/rpm-software-management/rpm/pull/936) listed above.
-* Gabriel Scherer:
- * [`ocaml`](https://github.com/ocaml/ocaml/pull/1515) (honor `BUILD_PATH_PREFIX_MAP`)
+* Chris Lamb:
+ * [#943954](https://bugs.debian.org/943954) filed against [tm-align](https://tracker.debian.org/pkg/tm-align).
+ * [#943956](https://bugs.debian.org/943956) filed against [snakemake](https://tracker.debian.org/pkg/snakemake) ([forwarded upstream](https://github.com/snakemake/snakemake/pull/80)).
+ * [#944131](https://bugs.debian.org/944131) filed against [splitpatch](https://tracker.debian.org/pkg/splitpatch) ([forwarded upstream](https://github.com/jaalto/splitpatch/pull/8)).
+ * [#944214](https://bugs.debian.org/944214) filed against [libaqbanking](https://tracker.debian.org/pkg/libaqbanking).
+ * [#944520](https://bugs.debian.org/944520) filed against [isbg](https://tracker.debian.org/pkg/isbg) ([forwarded upstream](https://github.com/isbg/isbg/pull/139)).
+ * [#944782](https://bugs.debian.org/944782) filed against [python-sybil](https://tracker.debian.org/pkg/python-sybil) ([forwarded upstream](https://github.com/cjw296/sybil/pull/18)).
+ * [#945105](https://bugs.debian.org/945105) filed against [intel-gpu-tools](https://tracker.debian.org/pkg/intel-gpu-tools).
+ * [#945576](https://bugs.debian.org/945576) filed against [superlu-dist](https://tracker.debian.org/pkg/superlu-dist).
+ * [#945822](https://bugs.debian.org/945822) filed against [liblopsub](https://tracker.debian.org/pkg/liblopsub).
+ * [genpy](https://github.com/ros/genpy/pull/110#event-2768597322)
* Vagrant Cascadian:
- * [`resource-agents`](https://github.com/ClusterLabs/resource-agents/pull/1428) (dash vs bash)
+ * [#944694](https://bugs.debian.org/944694) filed against [resource-agents](https://tracker.debian.org/pkg/resource-agents) ([forwarded upstream](https://github.com/ClusterLabs/resource-agents/commit/088707c81b7ddfc117490a035f9f2b2803728694)).
-#### Debian
+#### [diffoscope](https://diffoscope.org)
-* Rene Engelhard uploaded libreoffice (1:6.4.0~alpha1-0reprotest1) to experimental, with these changes relevant to r-b:
- * debian/rules, debian/tests/control:
- - temporarily disable all languages except en-US,de,he,ja, disable -g
- (and -dbgsym), don't run make check/build the test packages so that we
- hopefully don't timeout in the reproducible builds infrastructure
+[![]({{ "/images/reports/2019-10/diffoscope.svg#right" | prepend: site.baseurl }})](https://diffoscope.org)
-* Thorsten Glaser filed "#944691: dh: set umask 022 for all operations"
+diffoscope versions `131`, `132` and `133` was uploaded to Debian unstable by Chris Lamb. Chris also made the following changes:
-* Vagrant Cascadian uploaded [GNU Mes](https://www.gnu.org/software/mes/) to [Debian](https://tracker.debian.org/news/1080851/accepted-mes-020-1-source-amd64-into-experimental-experimental/).
+* New features / improvements:
+ * Allow all possible `.zip` file variations to return from external tools with non-zero exit codes, not just known types we can identify (eg. Java `.jmod` and `.jar` files). ([#78](https://salsa.debian.org/reproducible-builds/diffoscope/issues/78))
+ * Limit `.dsc` and `.buildinfo` file matching to files in ASCII or UTF-8 format. ([#77](https://salsa.debian.org/reproducible-builds/diffoscope/issues/77))
+ * Bump the previous `max_page_size` limit from 400 kB to 4 MB. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/7d6daf7)]
+ * Clarify in the HTML and text outputs that the limits are per-format, not global. ([#944882](https://bugs.debian.org/944882))
+ * Don't use line-base dbuffering when communucating with subprocesses in "binary" mode. ([#75](https://salsa.debian.org/reproducible-builds/diffoscope/issues/75))
-* [bug #944520](https://bugs.debian.org/944520) for isbg [forwarded](https://github.com/isbg/isbg/pull/139)
-* [bug #944707](https://bugs.debian.org/944707) for lintian
-* [bug #944782](https://bugs.debian.org/944782) for sybil [forwarded](https://github.com/cjw296/sybil/pull/18)
-* [bug #932116](https://bugs.debian.org/932116) and [#943956](https://bugs.debian.org/943956) for snakemake [forwarded](https://github.com/snakemake/snakemake/pull/80)
-* [bug #943694](https://bugs.debian.org/943694) for genpy [forwarded](https://github.com/ros/genpy/pull/110#event-2768597322)
-* [bug #944131](https://bugs.debian.org/944131) for splitpatch [forwarded](https://github.com/jaalto/splitpatch/pull/8)
+* Regression fixes:
+ * Correct the substitution/filtering of paths in ELF output to avoid unnecessary differences depending on the path name provided and commandline. ([#945572](https://bugs.debian.org/945572))
+ * Silence/correct a Python [`SyntaxWarning`](https://docs.python.org/3/library/exceptions.html#SyntaxWarning) message due to incorrectly comparing an integer by identity vs. equality. ([#945531](https://salsa.debian.org/reproducible-builds/diffoscope/commit/ecef7e6))
-#### Alpine Linux
+* Testsuite improvements:
+ * Refresh the [OCaml](https://ocaml.org/) test fixtures to support versions greater than 4.08.1. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/4754277)]
+ * Update an [Android manifest](https://developer.android.com/guide/topics/manifest/manifest-intro) test to reflect that parsed XML attributes are returned in a new/sorted manner under Python 3.8. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/c01dc80)]
+ * Dramatically Truncate the [tcpdump](https://www.tcpdump.org/) expected diff to 8KB from ~600KB to reduce the size of the release tarball. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/9c66d5f)]
+ * Add a self-test to encourage that new test data files are generated dynamically or at least no new ones are added without an explicit override. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/1c4b127)]
+ * Add a comment that the `text_ascii1` and `text_ascii2` fixture files are used in multiple tests so is not trivial to remove/replace them. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/69a8cc7)]
+ * Drop two more test fixture files for the directory tests. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/a0f7a11)]
+ * Don't run our self-test against the output of the [Black source code reformatter](https://black.readthedocs.io/en/stable/) with versions earlier than "ours" as it will generate different results. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/aefa5a3)]
+ * Update an XML test for Python 3.8. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/06d11dd)]
+ * Drop unused an unused `BASE_DIR` global. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/02497c9)]
-* FIXME: first reproducible Alpine package: https://mobile.twitter.com/n_copa/status/1192447768855482369
+* Code improvements:
+ * Rework a long string of `or` statements into a loop with a `break`. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/477584e)]
+ * Update code to reflect the latest version of the [Black](https://black.readthedocs.io/en/stable/) source code reformatter. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/75ea5c3)]
+ * Correct a reference to the `.rdx` extension suffix in a comment. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/4a00369)]
-#### Fdroid:
+Other contributions were also made from:
-* Holger increased / on osuosl168, our Fdroid build node, by 100G, to cope with the reproducible_fdroid_build_apps job finally succeeding building apps again.
+* Jelle van der Waa:
+ * Add support for comparing `.zst` files created by [Zstandard](https://github.com/facebook/zstd) compression algorith. ([#34](https://salsa.debian.org/reproducible-builds/issues/34))
-#### Arch Linux
+* Mattia Rizzolo:
+ * Install `python3-all` whilst running the [autopkgtests](https://ci.debian.net/) as we want to run the tests against all supported Python versions. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/cb74600)]
+ * Use `apt-get` instead of `apt` in our `Dockerfile`. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/a5c1364)]
+ * Add `zstd` to our test dependencies after the resolution of [#34](https://salsa.debian.org/reproducible-builds/issues/34). [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/2c87e96)]
-* The slight [green bump](https://tests.reproducible-builds.org/archlinux/archlinux.png) is due to a bug in the CI test framework where one build was building with --nocheck while the other did run and install the test dependencies leading to differences in the BUILDINFO file.
-* A lot of work has been put into getting [core] more reproducible, every package has been [rebuild](https://lists.archlinux.org/pipermail/arch-dev-public/2019-November/029721.html) with a new pacman which resolves an issue in storing the package size. Build failures and download issues have been resolved which lead to an increase of reproducible packages in the CI setup.
-* Morten Linderud (Foxboron) wrote a [blogpost](https://linderud.dev/blog/reproducible-arch-linux-packages/) on reproducible builds progress for Arch packages, how to reproduce packages and the future of reproducible builds progress.
-* The standard Arch development tools package devtools contains a new 'makerepropkg' tool which can reproduce a repository package given a PKGBUILD exists in the current working directory.
+#### strip-nondeterminism
-#### openSUSE
+[strip-nondeterminism](https://tracker.debian.org/pkg/strip-nondeterminism) is our tool to remove specific non-deterministic results from a completed build. This month, Chris Lamb added `file` as a dependency for `libfile-stripnondeterminism-perl` ([#945212](https://bugs.debian.org/945212)) and moved away from deprecated `$ADTTMP` variable [[...](https://salsa.debian.org/reproducible-builds/strip-nondeterminism.git/commit/803d5f9)], making two uploads in total (`1.6.2-1` & `1.6.3-1`).
+
+#### Project website
+
+[![]({{ "/images/reports/2019-11/website.png#right" | prepend: site.baseurl }})](https://reproducible-builds.org/)
+
+There was yet more effort put into our [our website](https://reproducible-builds.org/) this month, including:
+
+* Chris Lamb dropped a duplicated use the term "community" and other words [[...](https://salsa.debian.org/reproducible-builds/reproducible-website.git/commit/e390fe4)][[...](https://salsa.debian.org/reproducible-builds/reproducible-website.git/commit/7c14c50)], correcting the capitalisation of [GitHub](https://github.com/) & [GitLab](https://gitlab.org/) [[...](https://salsa.debian.org/reproducible-builds/reproducible-website.git/commit/ae47fcd)] and corrected the use of "an" [[...](https://salsa.debian.org/reproducible-builds/reproducible-website.git/commit/93fc479)].
+
+* Daniel Edgecumbe added a [section on initramfs and `.cpio` files]({{ "/docs/archives/" | prepend: site.baseurl }}#initramfs-images) to our [Archive Metadata]({{ "/docs/archives/" | prepend: site.baseurl }}) page. [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/c584cec)]
+
+* Hervé Boutemy added a link to [Maven Guide to Configuring for Reproducible Builds](https://maven.apache.org/guides/mini/guide-reproducible-builds.html) to [our JVM page]({{ "/docs/JVM/" | prepend: site.baseurl }}). [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/93fd259)]
-* Bernhard M. Wiedemann posted a [2019 summary of openSUSE updates](https://lists.reproducible-builds.org/pipermail/rb-general/2019-November/001722.html), including rpm, [high level openSUSE status](https://bugzilla.opensuse.org/show_bug.cgi?id=1133809), [fixing problems with .pyc files](https://bugzilla.opensuse.org/show_bug.cgi?id=1094323) which is also relevant to Arch Linux and [a nice graph](http://rb.zq1.de/compare.factory/graph.png).
+* Jelle van der Waa added [Arch Linux](https://archlinux.org/)-specific links for [diffoscope](https://diffoscope.org/) etc. to our [Tools]({{ "/docs/tools/" | prepend: site.baseurl }}) page. [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/0ca7223)]
-# include image: http://rb.zq1.de/compare.factory/graph.png
+#### Test framework
-* Posted [his monthly Reproducible Builds status update](https://lists.opensuse.org/opensuse-factory/2019-11/msg00370.html) for the [openSUSE](https://opensuse.org/) distribution.
+[![]({{ "/images/reports/2019-10/testframework.png#right" | prepend: site.baseurl }})](https://tests.reproducible-builds.org/)
-* Submitted patches to
- * [`brp-check-suse`](https://github.com/openSUSE/brp-check-suse/pull/29) (to strip LTO data from .o files)
- * [`pcc`](https://build.opensuse.org/request/show/745529) (fix FTBFS from LTO .a files)
- * [`nulloy`](https://build.opensuse.org/request/show/746033) (zip, [already upstream](https://github.com/nulloy/nulloy/pull/149))
- * [`cardpeek`](https://build.opensuse.org/request/show/746648) (fixup a previous patch)
- * [`cecilia`](https://build.opensuse.org/request/show/750463) (strip date+time in png)
- * [`abseil-cpp`](https://build.opensuse.org/request/show/750468) (sort find/readdir)
- * [`opencensus-cpp`](https://build.opensuse.org/request/show/751817) (sort find/readdir)
+We operate a comprehensive [Jenkins](https://jenkins.io/)-based testing framework that powers [tests.reproducible-builds.org](https://tests.reproducible-builds.org). This month, the following changes were made:
-#### Unsorted
+* Alexander Couzens ([OpenWrt](https://openwrt.org/)): Fix a typo in the `kirkwood` architecture. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/369038e3)]
-* [FIXME](https://twitter.com/acreature/status/1191426228852600837) The Manifest podcast talked with Chris Lamb about the Reproducible Builds project and Debian package management. [direct link](https://manifest.fm/14)
+[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/06c70874)]
+[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/c3cd0018)]
-* FIXME: [Jeremiah Orians announced the release of mescc-tools-seed v1.1](https://lists.reproducible-builds.org/pipermail/rb-general/2019-November/001711.html)
- https://github.com/oriansj/mescc-tools-seed
- Capable of bootstrapping from a simple hex assembler all the way to a cross-platform C compiler (M2-Planet) and a simplified version of Gnu MES (mes-m2). Work is still on going to finish a FULL version of Gnu MES, which will result in a full bootstrap from a 357byte bootstrap binary all the way to GCC. With 2 separate bootstraps already completed (x86 and AMD64) with more on the way (ARMv7l+aarch64)
+* Holger Levsen:
-* FIXME: [Hervé Boutemy <hboutemy at apache.org> announced the release of 3 base Maven plugins (source, jar and assembly) to get Reproducible Builds as direct Maven build output: see "Configuring for Reproducible Builds" documentation [1] for more details to try on your own projects built with Maven.](https://lists.reproducible-builds.org/pipermail/rb-general/2019-November/001708.html)
+ * Debian:
+ * Display newer suites first on pages showing the oldest build results. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/aa2ace2f)]
+ * Use the fully qualified-domain name (FQDN) when specifying hostnames in our [list of offline nodes](https://salsa.debian.org/qa/jenkins.debian.net/blob/HEAD/jenkins-home/offline_nodes). [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/8266e978)]
+ * Reflect that `coccia.debian.org` has changed IP address. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/25964ef8)]
+ * Ignore the [Maximum transmission Unit (MTU)](https://en.wikipedia.org/wiki/Maximum_transmission_unit) on `eth0` when checking for host health. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/1a549068)]
+ * Perform the "[`/usr` merge](https://wiki.debian.org/UsrMerge)" variation in the *unstable*, *experimental* and *bullseye* distributions but not on *buster*. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/a9919410)]
+ * [FreeBSD](https://www.freebsd.org/): Upgrade the test VM to FreeBSD 12.1. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/75e87e5d)]
+ * [Arch Linux](https://www.archlinux.org/):
+ * Don't fail build jobs if the call to `diffoscope --version` fails; be a bit more verbose in the job output instead. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/de6dce51)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/8ca7241c)]
+ * Attempt to be less error prone when ending [`schroot`](https://wiki.debian.org/Schroot) sessions. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/32b9fe26)]
+
+ * [OpenWrt](https://openwrt.org/):
+ * Additionally build the `brcm47xx`, `kirkwoot`, `lantiq`, `mediatek`, `omap`, `sunxi` and `tegra` targets. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/c40b5f5b)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/c40b5f5b)]
+ * Make build job outputs easier to read and thus understand. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/6baae828)]
+ * Include the build target and subtarget in summary paragraphs at the top of report pages. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/3f67936e)]
+ * Add a reminder to fix the job URL later. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/98c3e2c6)]
+
+ * Misc:
+ * Attempt to fix the [PureOS](https://pureos.net/) package set. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/c9066d49)]
+ * Shorten a "HOWTO" header a tiny bit. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/e6494947)]
+ * Drop hack to fix the clock. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/3a7ef746)]
+ * Improve a script header; patches are even more welcome than bugs! [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/ebefdd51)]
+ * Disable the use of the [OpenSSH](https://openssh.org/) `ControlMaster` feature to prevent [Jenkins](https://jenkins.io/) killing connections. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/81273bf4)]
+ * Make a number of improvements to our boilerplate texts/scripts. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/c3759e97)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/35c2b25f)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/2326d159)]
+
+* Jelle van der Waa: Skip running the [Arch Linux](https://archlinux.org/) tests for continuous builds and rebuilds. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/e16b3ee7)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/97145223)]
+
+* Mattia Rizzolo:
+ * Set the maximum size for HTML pages generated by [diffoscope](https://diffoscope.org) to 1MB (current default is 400 KB). [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/0a56df32)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/e2ce7d08)]
+ * Update and improve the backup routines for the email relay system managing `reproducible-builds.org`. [[...](https://salsa.debian.org/reproducible-builds/rb-mailx-ansible/commit/9563162)][[...](https://salsa.debian.org/reproducible-builds/rb-mailx-ansible/commit/734de20)]
+
+* Vagrant Cascadian:
+ * Ensure [OpenSSH](https://openssh.org/) `authorized_keys` files are processed in the correct directory regardless of where they are run from. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/0316d461)]
+ * Reduce the level of parallelism on `armhf` architectures with a lot of cores to reduce swapping on highly parallel builds, additionally ensuring level of parallelism are odd and even numbers on the first and second builds respectfully. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/620fa54d)]
+
+The usual node maintenance was performed by Holger Levsen. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/ec74bdf4)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/37d071e5)]
+
+---
-* Jan Nieuwenhuizen [announced the release of GNU Mes 0.21](https://lists.reproducible-builds.org/pipermail/rb-general/2019-November/001725.html).
+## Contributing
-* Vagrant Cascadian presented [*There and Back Again, Reproducibly*](https://osem.seagl.org/conferences/seagl2019/program/proposals/671) at [SeaGL](https://seagl.org) in Seattle, Washington November 16th 2019.
+If you are interested in contributing the Reproducible Builds project, please visit our [*Contribute*](https://reproducible-builds.org/contribute/) page on our website. However, you can get in touch with us via:
-* Mike Hommey did https://hg.mozilla.org/integration/autoland/rev/cd6b79c74b23 to fix "[Bug 1597903](https://bugzilla.mozilla.org/show_bug.cgi?id=1597903) - Add an error message when differences are found in diffoscope."
+ * IRC: `#reproducible-builds` on `irc.oftc.net`.
-* FIXME: science challenge mentions reproducible builds: Ten Years Reproducibility Challenge: https://rescience.github.io/ten-years/
+ * Twitter: [@ReproBuilds](https://twitter.com/ReproBuilds)
-* [FIXME](https://github.com/ocaml/ocaml/pull/1515#issuecomment-559035723) After two years and plenty discussion, the ocaml compiler project merged a change to support the `BUILD_PATH_PREFIX_MAP` environment variable.
+ * Mailing list: [`rb-general at lists.reproducible-builds.org`](https://lists.reproducible-builds.org/listinfo/rb-general)
-* [FIXME](https://www.meetup.com/NixOS-London/events/266848767) On 2019-12-09, the Nix project is hosting an event in London titled "Nix Papercuts Christmas Hackathon" to improve this project (that also aims for reproducibility)
+<br>
-* Eli Schwartz reported a bug to GNU groff for incomplete SOURCE_DATE_EPOCH support due to output files [embedding the timezone](https://savannah.gnu.org/bugs/?57218).
+This month's report was written by Arnout Engelen, Chris Lamb, Holger Levsen, Jelle van der Waa, Bernhard M. Wiedemann and Vagrant Cascadian. It was subsequently reviewed by a bunch of Reproducible Builds folks on IRC and the mailing list.
=====================================
_reports/2019-12.md
=====================================
@@ -2,7 +2,6 @@
layout: report
year: "2019"
month: "12"
-month_name: "December"
title: "Reproducible builds in December 2019"
draft: true
---
=====================================
images/reports/2019-11/alpine.png
=====================================
Binary files /dev/null and b/images/reports/2019-11/alpine.png differ
=====================================
images/reports/2019-11/archlinux.png
=====================================
Binary files /dev/null and b/images/reports/2019-11/archlinux.png differ
=====================================
images/reports/2019-11/coreboot.png
=====================================
Binary files /dev/null and b/images/reports/2019-11/coreboot.png differ
=====================================
images/reports/2019-11/debian.png
=====================================
Binary files /dev/null and b/images/reports/2019-11/debian.png differ
=====================================
images/reports/2019-11/diffoscope.svg
=====================================
@@ -0,0 +1,110 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+ xmlns:dc="http://purl.org/dc/elements/1.1/"
+ xmlns:cc="http://creativecommons.org/ns#"
+ xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+ xmlns:svg="http://www.w3.org/2000/svg"
+ xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink"
+ version="1.1"
+ width="128"
+ height="128"
+ id="svg2">
+ <defs
+ id="defs4" />
+ <metadata
+ id="metadata7">
+ <rdf:RDF>
+ <cc:Work
+ rdf:about="">
+ <dc:format>image/svg+xml</dc:format>
+ <dc:type
+ rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+ <dc:title></dc:title>
+ </cc:Work>
+ </rdf:RDF>
+ </metadata>
+ <g
+ transform="matrix(1.0692573,0,0,1.0692573,-328.34726,-503.5515)"
+ id="layer1">
+ <g
+ id="g5409">
+ <g
+ transform="translate(5.418238,0)"
+ id="g5386">
+ <rect
+ width="90.304001"
+ height="50.999996"
+ x="316.36414"
+ y="472.80621"
+ id="rect4667-3"
+ style="fill:none;stroke:none" />
+ <g
+ id="text4673-8"
+ style="font-size:64px;font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;text-align:start;line-height:125%;letter-spacing:0px;word-spacing:0px;writing-mode:lr-tb;text-anchor:start;fill:#008000;fill-opacity:1;stroke:none;font-family:Inconsolata;-inkscape-font-specification:Inconsolata Medium">
+ <path
+ d="m 316.36413,483.82622 0,3.968 26.304,0 0,-3.968"
+ id="path5371"
+ style="fill:#c00000;fill-opacity:1" />
+ <path
+ d="m 348.36413,483.82622 0,3.968 26.304,0 0,-3.968"
+ id="path5373"
+ style="fill:#c00000;fill-opacity:1" />
+ <path
+ d="m 380.36413,483.82622 0,3.968 26.304,0 0,-3.968"
+ id="path5375"
+ style="fill:#c00000;fill-opacity:1" />
+ </g>
+ <g
+ id="text5366"
+ style="font-size:64px;font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;text-align:start;line-height:125%;letter-spacing:0px;word-spacing:0px;writing-mode:lr-tb;text-anchor:start;fill:#008000;fill-opacity:1;stroke:none;font-family:Inconsolata;-inkscape-font-specification:Inconsolata Medium">
+ <path
+ d="m 327.69213,496.99019 0,10.88 -11.328,0 0,3.968 11.328,0 0,11.968 4.032,0 0,-11.968 10.944,0 0,-3.968 -10.944,0 0,-10.88 -4.032,0"
+ id="path5378" />
+ <path
+ d="m 359.69213,496.99019 0,10.88 -11.328,0 0,3.968 11.328,0 0,11.968 4.032,0 0,-11.968 10.944,0 0,-3.968 -10.944,0 0,-10.88 -4.032,0"
+ id="path5380" />
+ <path
+ d="m 391.69213,496.99019 0,10.88 -11.328,0 0,3.968 11.328,0 0,11.968 4.032,0 0,-11.968 10.944,0 0,-3.968 -10.944,0 0,-10.88 -4.032,0"
+ id="path5382" />
+ </g>
+ </g>
+ <use
+ id="use5399"
+ x="0"
+ y="0"
+ width="744.09448"
+ height="1052.3622"
+ xlink:href="#g5386" />
+ <use
+ transform="matrix(0.8,0,0,0.8,82.417275,133.65028)"
+ id="use5401"
+ style="opacity:0.85"
+ x="0"
+ y="0"
+ width="744.09448"
+ height="1052.3622"
+ xlink:href="#g5386" />
+ <use
+ transform="matrix(0.6,0,0,0.6,164.83455,260.05454)"
+ id="use5403"
+ style="opacity:0.7"
+ x="0"
+ y="0"
+ width="744.09448"
+ height="1052.3622"
+ xlink:href="#g5386" />
+ <use
+ transform="matrix(0.4,0,0,0.4,247.25182,379.25208)"
+ id="use5405"
+ style="opacity:0.55"
+ x="0"
+ y="0"
+ width="744.09448"
+ height="1052.3622"
+ xlink:href="#g5386" />
+ </g>
+ </g>
+</svg>
=====================================
images/reports/2019-11/gnu.png
=====================================
Binary files /dev/null and b/images/reports/2019-11/gnu.png differ
=====================================
images/reports/2019-11/guix.png
=====================================
Binary files /dev/null and b/images/reports/2019-11/guix.png differ
=====================================
images/reports/2019-11/maven.png
=====================================
Binary files /dev/null and b/images/reports/2019-11/maven.png differ
=====================================
images/reports/2019-11/ocaml.png
=====================================
Binary files /dev/null and b/images/reports/2019-11/ocaml.png differ
=====================================
images/reports/2019-11/opensuse-graph.png
=====================================
Binary files /dev/null and b/images/reports/2019-11/opensuse-graph.png differ
=====================================
images/reports/2019-11/opensuse.png
=====================================
Binary files /dev/null and b/images/reports/2019-11/opensuse.png differ
=====================================
images/reports/2019-11/openwrt.png
=====================================
Binary files /dev/null and b/images/reports/2019-11/openwrt.png differ
=====================================
images/reports/2019-11/reproducible-builds.png
=====================================
Binary files /dev/null and b/images/reports/2019-11/reproducible-builds.png differ
=====================================
images/reports/2019-11/summit.jpg
=====================================
Binary files /dev/null and b/images/reports/2019-11/summit.jpg differ
=====================================
images/reports/2019-11/testframework.png
=====================================
Binary files /dev/null and b/images/reports/2019-11/testframework.png differ
=====================================
images/reports/2019-11/themanifest.jpg
=====================================
Binary files /dev/null and b/images/reports/2019-11/themanifest.jpg differ
=====================================
images/reports/2019-11/website.png
=====================================
Binary files /dev/null and b/images/reports/2019-11/website.png differ
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/compare/7944f30d7bc12c2f7f8e03ffb5c80f95a1e655f5...48c282670a0c8857ad746b219861ab0418b1b7fb
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/compare/7944f30d7bc12c2f7f8e03ffb5c80f95a1e655f5...48c282670a0c8857ad746b219861ab0418b1b7fb
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-commits/attachments/20191209/d8214a96/attachment.htm>
More information about the rb-commits
mailing list