[Git][reproducible-builds/reproducible-website][master] 2021-06: Misc changes.
Chris Lamb (@lamby)
gitlab at salsa.debian.org
Sun Jul 4 14:17:24 UTC 2021
Chris Lamb pushed to branch master at Reproducible Builds / reproducible-website
Commits:
1602a470 by Chris Lamb at 2021-07-04T15:17:08+01:00
2021-06: Misc changes.
- - - - -
2 changed files:
- _reports/2021-06.md
- images/reports/2021-06/mirageos.png
Changes:
=====================================
_reports/2021-06.md
=====================================
@@ -8,7 +8,7 @@ draft: true
[![]({{ "/images/reports/2021-06/reproducible-builds.png#right" | relative_url }})](https://reproducible-builds.org/)
-**Welcome to latest report from the [Reproducible Builds](https://reproducible-builds.org) project for June 2021.** In these reports, we try outline the most important things that we have been happening in the world of reproducible builds and related areas during the past month. As ever, if you are interested in contributing to the project, please visit our [*Contribute*]({{ "/contribute/" | relative_url }}) page on our website.
+**Welcome to latest report from the [Reproducible Builds](https://reproducible-builds.org) project for June 2021.** In these reports we outline the most important things that have been happening in the world of reproducible builds in the past month. As ever, if you are interested in contributing to the project, please visit the [*Contribute*]({{ "/contribute/" | relative_url }}) page on our website.
<br>
@@ -16,7 +16,7 @@ draft: true
[![]({{ "/images/reports/2021-06/lwn.png#right" | relative_url }})](https://lwn.net/Articles/859965/)
-Jake Edge of [Linux Weekly News](https://lwn.net/) (LWN) published a [lengthy article on June 16th](https://lwn.net/Articles/859965/) describing various steps taken by the [Fedora](https://getfedora.org/) Linux distribution with respect to preventing supply-chain attacks:
+Jake Edge of [Linux Weekly News](https://lwn.net/) (LWN) published [a lengthy article on 16th June](https://lwn.net/Articles/859965/) describing various steps taken by the [Fedora Linux distribution](https://getfedora.org/) with respect to preventing supply-chain attacks:
> The specter of more events like the [SolarWinds supply-chain attacks](https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach) is something that concerns many in our communities—and beyond. Linux distributions provide a supply chain that obviously needs to be protected against attackers injecting malicious code into the update stream. This problem recently came up on the Fedora devel mailing list, which led to a discussion covering a few different topics. For the most part, Fedora users are protected against such attacks, which is not to say there is nothing more to be done, of course.
@@ -24,11 +24,11 @@ Jake Edge of [Linux Weekly News](https://lwn.net/) (LWN) published a [lengthy ar
[![]({{ "/images/reports/2021-06/google-open-source.png#right" | relative_url }})](https://security.googleblog.com/2021/06/introducing-slsa-end-to-end-framework.html)
-Last month, the [Google Security Blog](https://security.googleblog.com/) introduced a new framework called "[*Supply chain Levels for Software Artifacts*](https://security.googleblog.com/2021/06/introducing-slsa-end-to-end-framework.html)", or SLSA (to be pronounced as 'salsa'). In particular, SLSA level 4 ("currently the highest level") not only requires a two-person review of all changes but also "a hermetic, reproducible build process" due to its "many auditability and reliability benefits". Whilst a highly welcome inclusion in Google's requirements, by equating reproducible builds with only the highest level of supply-chain security in their list, it might lead others to conclude that only the most secure systems can benefit from the benefits of reproducible builds, whilst it is a belief of the Reproducible Builds project that many more users, if not all, can do so.
+The [Google Security Blog](https://security.googleblog.com/) introduced a new framework called "[*Supply chain Levels for Software Artifacts*](https://security.googleblog.com/2021/06/introducing-slsa-end-to-end-framework.html)", or SLSA (to be pronounced as 'salsa'). In particular, SLSA level 4 ("currently the highest level") not only requires a two-person review of all changes but also "a hermetic, reproducible build process" due to its "many auditability and reliability benefits". Whilst a highly welcome inclusion in Google's requirements, by equating reproducible builds with only the highest level of supply-chain security in their list, it might lead others to conclude that only the most secure systems can benefit from the benefits of reproducible builds, whilst it is a belief of the Reproducible Builds project that many more users, if not all, can do so.
<br>
-Many media outlets ([including The Verge](https://www.theverge.com/2021/6/8/22524307/anom-encrypted-messaging-fbi-europol-afp-sting-operation-trojan-shield-greenlight), etc.) reported on how the United States' FBI operated a messaging app as a 'honeypot trap' for a long period of time, leading to hundreds of arrests. [According to the UK's Financial Times](https://www.ft.com/content/65ed6eb5-4968-4636-99bc-27a516d089dd), court documents describe how the FBI persuaded a software developer facing prison to allow the FBI to commandeer the app and to introduce it to suspected criminals:
+Many media outlets (including [The Verge](https://www.theverge.com/2021/6/8/22524307/anom-encrypted-messaging-fbi-europol-afp-sting-operation-trojan-shield-greenlight), etc.) reported on how the United States' FBI operated a messaging app as a 'honeypot trap' for a long period of time, leading to hundreds of arrests. [According to the UK's Financial Times](https://www.ft.com/content/65ed6eb5-4968-4636-99bc-27a516d089dd), court documents describe how the FBI persuaded a software developer facing prison to allow the FBI to commandeer the app and to introduce it to suspected criminals:
[![]({{ "/images/reports/2021-06/anom.jpg#right" | relative_url }})](https://www.ft.com/content/65ed6eb5-4968-4636-99bc-27a516d089dd)
@@ -36,7 +36,15 @@ Many media outlets ([including The Verge](https://www.theverge.com/2021/6/8/2252
As the Financial Times reports, "it is unclear what exactly prompted the FBI and others to reveal the operation", although others have suggested it may result from legal limits in timeframes for intercepting communications. The FBI's operation raises ethical concerns which overlap with beliefs held by proponents of Reproducible Builds, not least of all because even the most unimpeachable actions by actors may result in the incidental surveillance of innocent people.
-In similar legal news, Susan Landau posted to the [Lawfare](https://www.lawfareblog.com/) blog about the [potential dangers posted by evidentiary software](https://www.lawfareblog.com/dangers-posed-evidentiary-softwareand-what-do-about-it). In particular, she discusses concerns that proprietary software may be fundamentally incompatible with the ability of defendants have the right to know the nature of the evidence against them — this is a right that is explicitly enshrined, for instance, in the [Sixth Amendment](https://en.wikipedia.org/wiki/Sixth_Amendment_to_the_United_States_Constitution) of United States Constitution. It is relevant here because if the inability to consult the relevant source code of does violate such rights, it may follow that a secure and reproducible build process will also be required — after all, it would be the output of the *binary* versions of the source code that is used to convict suspects, not the source code itself.
+<br>
+
+In similar legal news, Susan Landau posted to the [Lawfare blog](https://www.lawfareblog.com/) about the [potential dangers posted by evidentiary software](https://www.lawfareblog.com/dangers-posed-evidentiary-softwareand-what-do-about-it). In particular, she discusses concerns that proprietary software may be fundamentally incompatible with the ability of defendants have the right to know the nature of the evidence against them — this is a right that is explicitly enshrined, for instance, in the [Sixth Amendment](https://en.wikipedia.org/wiki/Sixth_Amendment_to_the_United_States_Constitution) of United States Constitution. However,
+
+> At the time of our writing the article on the use of software as evidence, there was no overriding requirement that [United States] law enforcement provide a defendant with the code so that they might examine it themselves.
+
+It is relevant here because if the inability to consult the relevant source code of does violate such rights, it may follow that a secure and reproducible build process will also be required — after all, it would be the output of the *binary* versions of the source code that is used to convict suspects, not the source code itself. As Susan points out:
+
+> Mistakes happen with software and sometimes the only way to find errors is to study the code itself—both of which have important implications for courtroom use of software programs.
<br>
@@ -50,16 +58,6 @@ The Reproducible Builds project restarted their IRC meetings this month. Taking
> Last year, packages downloaded thousands of times from [RubyGems](https://arstechnica.com/information-technology/2020/04/725-bitcoin-stealing-apps-snuck-into-ruby-repository/) installed malware that attempted to intercept bitcoin payments. Two years before that, someone backdoored a 2-million-user code library hosted in NPM. [Sonatype](https://sonatype.com/) has [tracked more than 12,000 malicious NPM packages](https://blog.sonatype.com/open-source-attacks-on-the-rise-top-8-malicious-packages-found-in-npm) since 2019.
-### Development news
-
-Dan Shearer from the [LumoSQL](https://lumosql.org/src/lumosql/doc/trunk/lumosql.org) database project [posted to our *rb-general* mailing list](https://lists.reproducible-builds.org/pipermail/rb-general/2021-June/002282.html) about reproducibility and microcode updates, emphasis ours:
-
-> Here at LumoSQL we do repeated runs testing SQLite of various versions and configurations, storing the results in an SQLite database. Here is an example of the kind of variation that justifies what some have called our 'too-fussy' test suite, a [*microcode update that changes behaviour from one day to another*](https://travisdowns.github.io/blog/2021/06/17/rip-zero-opt.html).
-
-<br>
-
-In [last month's report]({{ "/reports/2021-05" | relative_url }}) we wrote about Paul Spooren [proposing a patch](http://lists.busybox.net/pipermail/busybox/2021-May/088842.html) for the [BusyBox](https://www.busybox.net/) suite of UNIX utilities so that it uses [`SOURCE_DATE_EPOCH`]({{ "/specs/source-date-epoch/" | relative_url }}) for build timestamps if available. This was [merged during June](http://lists.busybox.net/pipermail/busybox/2021-June/088880.html) by Denys Vlasenko.
-
<br>
### Distribution work
@@ -68,11 +66,11 @@ In [last month's report]({{ "/reports/2021-05" | relative_url }}) we wrote about
[Ariadne Conill](https://ariadne.space/) published a [detailed blog post](https://ariadne.space/2021/06/04/a-slightly-delayed-monthly-status-update/) this month detailing their work on security issues and concerns in the [Alpine](https://alpinelinux.org/) Linux distribution. In particular, Ariadne included an interesting section on an effort "to prove the reproducibility of Alpine package builds":
-> To this end, I hope to have the Alpine 3.15 build fully reproducible. This will require some changes to [`abuild`](https://wiki.alpinelinux.org/wiki/Abuild_and_Helpers) so that it produces `buildinfo files`, as well as a rebuilder backend. We plan to use the same buildinfo format as [Arch [Linux]](https://archlinux.org/), and will likely adapt some of the other reproducible builds work Arch has done to Alpine.
+> To this end, I hope to have the Alpine 3.15 build fully reproducible. This will require some changes to [`abuild`](https://wiki.alpinelinux.org/wiki/Abuild_and_Helpers) so that it produces `buildinfo files`, as well as a rebuilder backend. We plan to use the same buildinfo format as [Arch Linux](https://archlinux.org/), and will likely adapt some of the other reproducible builds work Arch has done to Alpine.
-Ariadne mentions plans to have a meeting and a sprint during July, to be organised in and around the `#alpine-reproducible` channel on the [OFTC IRC network](https://www.oftc.net/).
+Ariadne mentioned plans to have a meeting and a sprint during July, to be organised in and around the `#alpine-reproducible` channel on the [OFTC IRC network](https://www.oftc.net/), and later posted a [round-up of security initiatives in Alpine during June](https://ariadne.space/2021/07/01/bits-relating-to-alpine-security-initiatives-in-june/) which mentions, amongst many other things, the ability to demonstrate [reproducible Alpine install images for the Raspberry Pi](https://twitter.com/sn0int/status/1410280462296268809).
-Elsewhere in Alpine news, [*kpcyrd*](https://github.com/kpcyrd) posted a series of Tweets explaining the steps he made for an reproducible Alpine image. [[1](https://twitter.com/sn0int/status/1408853977106718724)] [[2](https://twitter.com/sn0int/status/1410280372051582978)]
+Elsewhere in Alpine news, [*kpcyrd*](https://github.com/kpcyrd) posted a series of Tweets explaining the steps he made for an reproducible Alpine image. [[1](https://twitter.com/sn0int/status/1408853977106718724)] [[2](https://twitter.com/sn0int/status/1410280372051582978)]
<br>
@@ -82,15 +80,13 @@ The [NixOS](https://nixos.org/) Linux distribution pulled off a technical and pu
<br>
-[![]({{ "/images/reports/2021-06/debian.png#right" | relative_url }})](https://debian.org)
-
In early June, Nilesh Patra [asked for help making Debian's `brian` package build reproducibly](https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20210607/013052.html). Felix C. Stegerman proposed two patches which seem to have fixed the remaining issues ([#989693](https://bugs.debian.org/989693)). These were submitted upstream, where they were shortly merged.
<br>
[![]({{ "/images/reports/2021-06/fdroid.png#right" | relative_url }})](https://www.f-droid.org/)
-Felix C. Stegerman announced the release of v1.0.0 of [*apksigcopier*](https://github.com/obfusk/apksigcopier), a tool to copy, extract and patch `.apk` signatures needed to facilitate reproducible builds on the [F-Droid](https://f-droid.org) Android application store. Holger Levsen subsequently sponsored an upload to Debian.
+Felix C. Stegerman announced the release of v1.0.0 of [*apksigcopier*](https://github.com/obfusk/apksigcopier), a tool to copy, extract and patch `.apk` signatures needed to facilitate reproducible builds on the [F-Droid](https://f-droid.org) Android application store. Holger Levsen subsequently sponsored an upload to Debian. Felix C. Stegerman also reported that Android builds are sometimes not reproducible due to a bug in [NewPipe](https://newpipe.net/) that affects the `coreLibraryDesugaring` routine. [[...](https://github.com/TeamNewPipe/NewPipe/issues/6486)]
Elsewhere in F-Droid, the Swiss COVID Certificate mobile app (which uses reproducible builds) has [been added to F-Droid](https://gitlab.com/fdroid/fdroiddata/-/merge_requests/9099) — the F-Droid developers have mentioned that the upstream developers have been very helpful in making this happen. Relatedly, the Android version of the [Electrum Bitcoin Wallet](https://electrum.org/#home) [has been made reproducible](https://github.com/spesmilo/electrum/pull/7263).
@@ -98,7 +94,7 @@ Elsewhere in F-Droid, the Swiss COVID Certificate mobile app (which uses reprodu
[![]({{ "/images/reports/2021-06/mirageos.png#right" | relative_url }})](https://mirage.io)
-[Hannes Mehnert](https://hannes.robur.coop/) announced the launch of the [reproducible MirageOS build infrastructure](https://hannes.robur.coop/Posts/Deploy), together with where to [obtain 'unikernels'](https://builds.robur.coop): "To provide a high level of assurance and trust, if you distribute binaries in 2021, you should have a recipe how they can be reproduced in a bit-by-bit identical way."
+Lastly, [Hannes Mehnert](https://hannes.robur.coop/) announced the launch of the [reproducible MirageOS build infrastructure](https://hannes.robur.coop/Posts/Deploy), together with where to [obtain 'unikernels'](https://builds.robur.coop): "To provide a high level of assurance and trust, if you distribute binaries in 2021, you should have a recipe how they can be reproduced in a bit-by-bit identical way."
<br>
@@ -147,13 +143,13 @@ Separate to this, Hans-Christoph Steiner noted there is a [reproducibility-relat
<br>
-### [diffoscope](https://diffoscope.org)
+### [*diffoscope*](https://diffoscope.org)
[![]({{ "/images/reports/2021-06/diffoscope.svg#right" | relative_url }})](https://diffoscope.org)
-[*diffoscope*](https://diffoscope.org) is the Reproducible Builds project in-depth and content-aware diff utility. Not only can it locate and diagnose reproducibility issues, it provides human-readable diffs from many kinds of binary formats.
+[*diffoscope*](https://diffoscope.org) is our in-depth and content-aware diff utility. Not only can it locate and diagnose reproducibility issues, it provides human-readable diffs from many kinds of binary formats.
-This month, [Chris Lamb](https://chris-lamb.co.uk) made a number of changes including releasing [version 177](https://diffoscope.org/news/diffoscope-177-released/)). In addition, Chris updated the [*try.diffoscope.org*](https://try.diffoscope.org) service to reflect that they were [acquired by the Iomart Group](https://blog.bytemark.co.uk/2018/09/04/moving-up-the-stack) [[...](https://salsa.debian.org/reproducible-builds/try.diffoscope.org/commit/3e5c73a)].
+This month, [Chris Lamb](https://chris-lamb.co.uk) made a number of changes including releasing [version 177](https://diffoscope.org/news/diffoscope-177-released/)). In addition, Chris updated the [*try.diffoscope.org*](https://try.diffoscope.org) service to reflect that they were [acquired by the Iomart Group](https://blog.bytemark.co.uk/2018/09/04/moving-up-the-stack). [[...](https://salsa.debian.org/reproducible-builds/try.diffoscope.org/commit/3e5c73a)].
* Balint Reczey:
@@ -182,15 +178,15 @@ A number of few changes were made to the [main Reproducible Builds website and d
* Arnout Engelen:
- * Credit Ludovic Courtès for the Guix page. [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/ed7e5c6)]
- * Fix link to NixOS. [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/380be47)]
+ * Credit Ludovic Courtès for the [Guix](https://guix.gnu.org/) page. [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/ed7e5c6)]
+ * Fix link to [NixOS](https://nixos.org/). [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/380be47)]
* Chris Lamb:
* Use an ellipsis [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/326bacd)] and drop a full stop [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/60347ac)] to clarify 'more items' links.
- * Update the link and logo to [Google Open Source Security Team](https://security.googleblog.com/). [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/a1b9aed)]
- * Reduce the amount of bold text on [the homepage]({{ "/" | relative_url }}). [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/e9f44ea)]
- * Document the non-reproducibility arising from abbreviated Git hashes [depending on the number of total objects in a Git repository]({{ "/docs/version-information/" | relative_url }}#git-checksums). [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/-/issues/31)]
+ * Update the link and logo to [Google Open Source Security Team](https://security.googleblog.com/). [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/a1b9aed)]
+ * Reduce the amount of bold text on [the homepage]({{ "/" | relative_url }}). [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/e9f44ea)]
+ * Document the non-reproducibility arising from abbreviated Git hashes [depending on the number of total objects in a Git repository]({{ "/docs/version-information/" | relative_url }}#git-checksums). [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/-/issues/31)]
* Hervé Boutemy:
@@ -203,7 +199,7 @@ A number of few changes were made to the [main Reproducible Builds website and d
* Mattia Rizzolo:
* Fix a typo in a CSS class name. [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/e2c8ee1)]
- * Add the (now-superseded) [Core Infrastructure Initiative](https://www.coreinfrastructure.org/) to the list of historical sponsors. [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/6d042f3)]
+ * Add the (now-superseded) Linux Foundation [Core Infrastructure Initiative](https://www.coreinfrastructure.org/) to the list of historical sponsors. [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/6d042f3)]
<br>
@@ -232,7 +228,7 @@ The Reproducible Builds project operates a [Jenkins](https://jenkins.io/)-based
* Detect failure to "make tools". [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/75389717)]
* Also detect "no route to host" issues. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/aef1c204)]
* Tune regular expression to detect proxy failures. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/bbaad8a1)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/a7feb4a6)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/d70fca31)]
- * Misc aesthetic changes to the status page. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/99228d13)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/a77f4de9)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/457c6f30)]
+ * Misc aesthetic changes to the status page. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/99228d13)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/a77f4de9)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/457c6f30)]
* Misc:
@@ -246,42 +242,40 @@ The Reproducible Builds project operates a [Jenkins](https://jenkins.io/)-based
* Update the documentation regarding manual scheduling Debian builds to drop old references to the deprecated [Alioth](https://wiki.debian.org/Alioth) system. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/7a500fe1)]
* Update a number of IP addresses for `armhf` architecture machines. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/b242c74a)]
-* Roland Clobus (FIXME below):
-
- * Cleanup RESULTSDIR when safe; publish results; unify whitespace. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/1006e099)]
- * Use a different folder for the results, that is accessible from the schroot. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/dbc9471d)]
- * Create a subdirectory for the ISO files, add more logging to the diffoscope call and publish the output of diffoscope. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/1966e740)]
- * Add DIFFOSCOPE environment variable. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/dac906bf)]
- * call\_diffoscope requires the variable TIMEOUT to be set. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/a5d19afd)]
- * Fixed invocation of mktemp with --tmpdir. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/396680fc)]
- * Fixed location of 'rm' command. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/36c954df)]
- * Cleanup with sudo Call 'lb config' before the second build. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/31b0c6c5)]
- * 'lb clean --purge' requires root rights. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/456664d6)]
- * Use TMPDIR instead of MY\_WORKSPACE, because call\_diffoscope assumes TMPDIR to be set. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/ffb6bdd9)]
- * Use and clean an isolated workspace. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/5ce264f5)]
- * Spelling corrections. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/eb492694)]
- * Allow SOURCE\_DATE\_EPOCH and LIVE\_BUILD to enter the sudo environment. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/cad52f63)]
- * The environment variables must be before the command in sudo. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/abb8bef8)]
- * sudo needs 2 environment variables set: SOURCE\_DATE\_EPOCH and LIVE\_BUILD. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/41cdf7e7)]
- * Build live images twice and compare the output. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/c2987737)]
+* Roland Clobus spent significant time on automatically building [Debian Live](https://www.debian.org/CD/live/) images twice and [comparing the output if they differ](https://wiki.debian.org/ReproducibleInstalls/LiveImages) ([Jenkins job page](https://jenkins.debian.net/job/reproducible_debian_live_build/)). This included:
+
+ * Actually build the images twice and compare the output. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/c2987737)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/a5d19afd)]
+ * Improve cleanup routines. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/1006e099)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/36c954df)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/ffb6bdd9)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/456664d6)]
+ * Store the ISO output. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/dbc9471d)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/1966e740)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/5ce264f5)]
+ * Various `sudo(8)`-related configuration changes. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/cad52f63)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/abb8bef8)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/41cdf7e7)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/31b0c6c5)]
* Vagrant Cascadian:
* Document the access to the `armhf` architecture host servers. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/12dd6947)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/1bfe9112)]
* Update the number of `armhf` architecture jobs and machines. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/bbf5e229)]
- * Add build jobs and SSH keys (etc.) for various new machines. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/38eba435)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/b8b85dba)]
+ * Add build jobs and [SSH keys](https://www.openssh.com/) (etc.) for various new machines. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/38eba435)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/b8b85dba)]
Finally, build node maintenance was performed by Holger Levsen [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/93ee8ecb)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/994026c2)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/57abb28c)], Mattia Rizzolo [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/033d2a6c)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/e39f00c3)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/956888c8)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/24aac701)] and Vagrant Cascadian [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/5f452539)].
<br>
+### Misc development news
+
+Dan Shearer from the [LumoSQL](https://lumosql.org) database project [posted to the *rb-general* mailing list](https://lists.reproducible-builds.org/pipermail/rb-general/2021-June/002282.html) about reproducibility and microcode updates, emphasis ours:
+
+> Here at LumoSQL we do repeated runs testing [SQLite](https://www.sqlite.org/index.html) of various versions and configurations, storing the results in an SQLite database. Here is an example of the kind of variation that justifies what some have called our 'too-fussy' test suite, a [*microcode update that changes behaviour from one day to another*](https://travisdowns.github.io/blog/2021/06/17/rip-zero-opt.html).
+
+Finally, in [last month's report]({{ "/reports/2021-05" | relative_url }}) we wrote about Paul Spooren [proposing a patch](http://lists.busybox.net/pipermail/busybox/2021-May/088842.html) for the [BusyBox](https://www.busybox.net/) suite of UNIX utilities so that it uses [`SOURCE_DATE_EPOCH`]({{ "/specs/source-date-epoch/" | relative_url }}) for build timestamps if available. This was [merged during June](http://lists.busybox.net/pipermail/busybox/2021-June/088880.html) by Denys Vlasenko.
+
+<br>
+
+---
+
If you are interested in contributing to the Reproducible Builds project, please visit our [*Contribute*](https://reproducible-builds.org/contribute/) page on our website. However, you can get in touch with us via:
* IRC: `#reproducible-builds` on `irc.oftc.net`.
- * Twitter: [@ReproBuilds](https://twitter.com/ReproBuilds)
-
- * Mastodon: [@reproducible_builds at fosstodon.org](https://fosstodon.org/@reproducible_builds)
+ * Twitter ([@ReproBuilds](https://twitter.com/ReproBuilds)) and Mastodon ([@reproducible_builds at fosstodon.org](https://fosstodon.org/@reproducible_builds)).
* Reddit: [/r/ReproducibleBuilds](https://reddit.com/r/reproduciblebuilds)
=====================================
images/reports/2021-06/mirageos.png
=====================================
Binary files a/images/reports/2021-06/mirageos.png and b/images/reports/2021-06/mirageos.png differ
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/1602a47011af8c30619c0f8d07bc85732ffcab5f
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/1602a47011af8c30619c0f8d07bc85732ffcab5f
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-commits/attachments/20210704/8a4253ce/attachment.htm>
More information about the rb-commits
mailing list