[Git][reproducible-builds/reproducible-website][master] 2023-02: some improvements
FC Stegerman (@obfusk)
gitlab at salsa.debian.org
Sat Mar 4 03:15:31 UTC 2023
FC Stegerman pushed to branch master at Reproducible Builds / reproducible-website
Commits:
fb7c120e by FC Stegerman at 2023-03-04T04:14:56+01:00
2023-02: some improvements
- - - - -
1 changed file:
- _reports/2023-02.md
Changes:
=====================================
_reports/2023-02.md
=====================================
@@ -39,7 +39,7 @@ Anthony Harrison wrote to our list twice, first by [introducing himself and thei
[![]({{ "/images/reports/2023-02/almalinux.png#right" | relative_url }})](https://retout.co.uk/2023/02/04/almalinux-and-sboms/)
-[Tim Retout](https://retout.co.uk/) wrote a blog post discussing [AlmaLinux](https://almalinux.org/) in the context of CentOS, RHEL and supply-chain security in general. [[...](https://retout.co.uk/2023/02/04/almalinux-and-sboms/)]:
+[Tim Retout](https://retout.co.uk/) wrote a blog post discussing [AlmaLinux](https://almalinux.org/) in the context of CentOS, RHEL and supply-chain security in general [[...](https://retout.co.uk/2023/02/04/almalinux-and-sboms/)]:
> Alma are generating and publishing Software Bill of Material (SBOM) files for
> every package; these are becoming a requirement for all software sold to the
@@ -60,7 +60,7 @@ Anthony Harrison wrote to our list twice, first by [introducing himself and thei
* Roland Clobus posted his [latest update of the status of reproducible Debian ISO images](https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/002877.html) noting that "all major desktops build reproducibly with *bullseye*, *bookworm* and *sid*," with the caveat that "when non-free firmware is activated, some non-reproducible files are generated".
-* FC Stegerman submitted a new [Intent to Package (ITP)](https://wiki.debian.org/ITP#) bug report [representing an intention to package `repro-apk`](https://bugs.debian.org/1030768), a set of [scripts to make Android `.apk` files reproducible](https://github.com/obfusk/reproducible-apk-tools).
+* FC Stegerman submitted a new [Intent to Package (ITP)](https://wiki.debian.org/ITP) bug report [representing an intention to package `repro-apk`](https://bugs.debian.org/1030768), a set of [scripts to make Android `.apk` files reproducible](https://github.com/obfusk/reproducible-apk-tools).
* 23 reviews of Debian packages were added, 24 were updated and 20 were removed this month adding to [our knowledge about identified issues](https://tests.reproducible-builds.org/debian/index_issues.html). A new issue was added and identified by Chris Lamb [[...](https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/c2b3882c)], and the `timestamps_embedded_in_manpages_by_node_marked_man` issue has been marked as resolved [[...](https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/5cb5d781)].
@@ -70,15 +70,15 @@ Anthony Harrison wrote to our list twice, first by [introducing himself and thei
[![]({{ "/images/reports/2023-02/fdroid.png#right" | relative_url }})](https://f-droid.org/)
-* There's now an [overview of F-Droid apps published with Reproducible Builds](https://gitlab.com/obfusk/fdroid-misc-scripts/-/blob/master/reproducible/overview.md).
+* F-Droid added 21 more apps published with reproducible builds this month, the [overview of F-Droid apps published with Reproducible Builds](https://gitlab.com/obfusk/fdroid-misc-scripts/-/blob/master/reproducible/overview.md) now includes graphs, and there are now also some [graphs of F-Droid apps verified by the Verification Server](https://gitlab.com/obfusk/fdroid-misc-scripts/-/blob/master/verification/graphs.md).
-* FC Stegerman noticed that [signatures made by older AGP versions cannot be copied](https://github.com/obfusk/apksigcopier/issues/88), because the signing method differs too much from that used by [apksigner](https://developer.android.com/studio/command-line/apksigner) (and [signflinger](https://android.googlesource.com/platform/tools/base/+/studio-master-dev/signflinger/)).
+* FC Stegerman noticed that [signatures made by older versions of Android Gradle plugin cannot be copied](https://github.com/obfusk/apksigcopier/issues/88), because the signing method differs too much from that used by [*apksigner*](https://developer.android.com/studio/command-line/apksigner) (and [*signflinger*](https://android.googlesource.com/platform/tools/base/+/studio-master-dev/signflinger/)).
* FC Stegerman also created a helpful HOWTO page on the [F-Droid Wiki](https://gitlab.com/fdroid/wiki/-/wikis/pages) detailing how to [compare and subsequently make APKs reproducible](https://gitlab.com/fdroid/wiki/-/wikis/HOWTO:-diff-&-fix-APKs-for-Reproducible-Builds).
-* A long-running thread on [*Hiding data/code in Android APK embedded signatures*](https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/thread.html#2828) continued on [our mailing list](https://lists.reproducible-builds.org/listinfo/rb-general/) this month.
+* A long-running thread on [*Hiding data/code in Android APK embedded signatures*](https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/thread.html#2828) continued on [our mailing list](https://lists.reproducible-builds.org/listinfo/rb-general/) this month; [*apksigcopier*](https://github.com/obfusk/apksigcopier) `v1.1.1` and [*reproducible-apk-tools*](https://github.com/obfusk/reproducible-apk-tools) `v0.2.2` + `v0.2.3` were also [announced](https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/002853.html) on the same list.
-* Lastly, FC Stegerman reported two issues on Google's own issue tracker: firstly, related to a non-deterministic "Dependency Info Block" [[...](https://issuetracker.google.com/issues/268071369)] and a "virtual entry" added by the [signflinger](https://android.googlesource.com/platform/tools/base/+/studio-master-dev/signflinger/) tool makes builds unreproducible as well [[...](https://issuetracker.google.com/issues/268071371)].
+* Lastly, FC Stegerman reported two issues on Google's own issue tracker: one related to a non-deterministic "Dependency Info Block" [[...](https://issuetracker.google.com/issues/268071369)] and another about a "virtual entry" added by the [*signflinger*](https://android.googlesource.com/platform/tools/base/+/studio-master-dev/signflinger/) tool causing unexpected differences between signed and unsigned APKs [[...](https://issuetracker.google.com/issues/268071371)].
---
@@ -88,31 +88,30 @@ Anthony Harrison wrote to our list twice, first by [introducing himself and thei
[*diffoscope*](https://diffoscope.org) is our in-depth and content-aware diff utility. Not only can it locate and diagnose reproducibility issues, it can provide human-readable diffs from many kinds of binary formats.
-This month, Chris Lamb released versions [`235`](https://diffoscope.org/news/diffoscope-235-released/), [`236`](https://diffoscope.org/news/diffoscope-236-released/) and Mattia Rizzolo later released version [`237`](https://diffoscope.org/news/diffoscope-237-released/).
+This month, Chris Lamb released versions [`235`](https://diffoscope.org/news/diffoscope-235-released/) and [`236`](https://diffoscope.org/news/diffoscope-236-released/); Mattia Rizzolo later released version [`237`](https://diffoscope.org/news/diffoscope-237-released/).
Contributions include:
* Chris Lamb:
- * Fix compatibility with PyPDF2. (re. issue [#331](https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/331)) [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/82a767d2)][[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/ff6d9bbd)][[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/ccf3c2a4)]
- * Fix compatibility with [ImageMagick](https://imagemagick.org) version 7.1. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/60ea9cc6)]
- * Require at least version 23.1.0 to run the [Black](https://github.com/psf/black) source code tests. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/c45de0a1)]
- * Update `debian/tests/control` after merging changes from others. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/72e5b2a1)]
- * Don't write test data during a test. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/25dcd1e6)]
- * Update copyright years. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/be3973b0)]
+ * Fix compatibility with PyPDF2 (re. issue [#331](https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/331)) [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/82a767d2)][[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/ff6d9bbd)][[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/ccf3c2a4)].
+ * Fix compatibility with [ImageMagick](https://imagemagick.org) version 7.1 [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/60ea9cc6)].
+ * Require at least version 23.1.0 to run the [Black](https://github.com/psf/black) source code tests [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/c45de0a1)].
+ * Update `debian/tests/control` after merging changes from others [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/72e5b2a1)].
+ * Don't write test data during a test [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/25dcd1e6)].
+ * Update copyright years [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/be3973b0)].
* Merged a large number of changes from others.
-* Akihiro Suda edited the `.gitlab-ci.yml` configuration file to ensure that versioned tags are pushed to the container registry. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/637c2985)]
+* Akihiro Suda edited the `.gitlab-ci.yml` configuration file to ensure that versioned tags are pushed to the container registry [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/637c2985)].
-* Daniel Kahn Gillmor provided a way to migrate from PyPDF2 to pypdf. ([#1029741](https://bugs.debian.org/1029742))
+* Daniel Kahn Gillmor provided a way to migrate from PyPDF2 to pypdf ([#1029741](https://bugs.debian.org/1029742)).
-* Efraim Flashner updated the tool metadata for `isoinfo` on [GNU Guix](https://guix.gnu.org/). [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/7d6ce503)]
+* Efraim Flashner updated the tool metadata for `isoinfo` on [GNU Guix](https://guix.gnu.org/) [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/7d6ce503)].
-* FC Stegerman added support for Android `resources.arsc` files. [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/7cf77ed1)],
-improved a number of file-matching regular expressions [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/8d7762f6)][[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/c988c3ad)] and added support for Android `dexdump` [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/1bb9b812)].
+* FC Stegerman added support for Android `resources.arsc` files [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/7cf77ed1)], improved a number of file-matching regular expressions [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/8d7762f6)][[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/c988c3ad)] and added support for Android `dexdump` [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/1bb9b812)]; they also [fixed](https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/f48fbe61) a test failure ([#1031433](https://bugs.debian.org/1031433)) caused by Debian's `black` package having been updated to a newer version.
* Mattia Rizzolo:
* updated the release documentation [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/b17b0595)],
* fixed a number of [Flake8](https://flake8.pycqa.org/en/latest/) errors [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/8f710cd5)][[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/6eb8d06f)],
- * updated the autopkgtest configuration to only install `appt` and `dexdump` on architectures where they are available [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/61f7c2b3)], making sure that the latest diffoscope release is in a good fit for the upcoming Debian bookworm freeze.
+ * updated the autopkgtest configuration to only install `aapt` and `dexdump` on architectures where they are available [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/61f7c2b3)], making sure that the latest diffoscope release is in a good fit for the upcoming Debian bookworm freeze.
---
@@ -120,9 +119,9 @@ improved a number of file-matching regular expressions [[...](https://salsa
[Reprotest](https://salsa.debian.org/reproducible-builds/reprotest) version 0.7.23 was uploaded to both [PyPI](https://pypi.org/) and Debian unstable, including the following changes:
-* Holger Levsen improved a lot of documentation [[...](https://salsa.debian.org/reproducible-builds/reprotest/commit/296800e)][[...](https://salsa.debian.org/reproducible-builds/reprotest/commit/82d585b)][[...](https://salsa.debian.org/reproducible-builds/reprotest/commit/b2a6f6f)] tidied the documentation [[...](https://salsa.debian.org/reproducible-builds/reprotest/commit/e8d9476)][[...](https://salsa.debian.org/reproducible-builds/reprotest/commit/84496fa)] as well as experimented with a new `--random-locale` flag [[...](https://salsa.debian.org/reproducible-builds/reprotest/commit/f76f6e1)].
+* Holger Levsen improved a lot of documentation [[...](https://salsa.debian.org/reproducible-builds/reprotest/commit/296800e)][[...](https://salsa.debian.org/reproducible-builds/reprotest/commit/82d585b)][[...](https://salsa.debian.org/reproducible-builds/reprotest/commit/b2a6f6f)] and tidied the documentation as well [[...](https://salsa.debian.org/reproducible-builds/reprotest/commit/e8d9476)][[...](https://salsa.debian.org/reproducible-builds/reprotest/commit/84496fa)] as well as experimented with a new `--random-locale` flag [[...](https://salsa.debian.org/reproducible-builds/reprotest/commit/f76f6e1)].
-* Vagrant Cascadian adjusted *reprotest* to no longer randomise the build locale and use a UTF-8 supported locale instead[..](https://salsa.debian.org/reproducible-builds/reprotest/-/commit/610e6cae15fe8d066303694af97bf3a09a6b01c2) (re. [#925879](https://bugs.debian.org/925879), [#1004950](https://bugs.debian.org/1004950)), and also support passing `--vary=locales.locale=LOCALE` to specify the locale to vary [[...](https://salsa.debian.org/reproducible-builds/reprotest/commit/a92f741)].
+* Vagrant Cascadian adjusted *reprotest* to no longer randomise the build locale and use a UTF-8 supported locale instead [[...]](https://salsa.debian.org/reproducible-builds/reprotest/-/commit/610e6cae) (re. [#925879](https://bugs.debian.org/925879), [#1004950](https://bugs.debian.org/1004950)), and also support passing `--vary=locales.locale=LOCALE` to specify the locale to vary [[...](https://salsa.debian.org/reproducible-builds/reprotest/commit/a92f741)].
Separate to this, Vagrant Cascadian started a thread on our [mailing list](https://lists.reproducible-builds.org/listinfo/rb-general) questioning the [future development and direction of *reprotest*](https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/002876.html).
@@ -134,7 +133,7 @@ The Reproducible Builds project detects, dissects and attempts to fix as many cu
* Bernhard M. Wiedemann:
- * [`aiohttp`](https://github.com/aio-libs/aiohttp/pull/7191) (build fails in teh future)
+ * [`aiohttp`](https://github.com/aio-libs/aiohttp/pull/7191) (build fails in the future)
* [`diff-pdf`](https://bugzilla.opensuse.org/show_bug.cgi?id=1180471)
* [`dpdk`](https://build.opensuse.org/request/show/1067125)
* [`ebumeter`](https://build.opensuse.org/request/show/1066747) (CPU-related issue)
@@ -150,7 +149,7 @@ The Reproducible Builds project detects, dissects and attempts to fix as many cu
* [#1030708](https://bugs.debian.org/1030708) filed against [`gap-browse`](https://tracker.debian.org/pkg/gap-browse).
* [#1030714](https://bugs.debian.org/1030714) filed against [`cwltool`](https://tracker.debian.org/pkg/cwltool).
* [#1030715](https://bugs.debian.org/1030715) filed against [`adacgi`](https://tracker.debian.org/pkg/adacgi).
- * [#1030724](https://bugs.debian.org/1030724) filed against [`node-marked-man`](https://tracker.debian.org/pkg/node-marked-man) ([forwarded upstream](https://github.com/kapouer/marked-man/pull/32))
+ * [#1030724](https://bugs.debian.org/1030724) filed against [`node-marked-man`](https://tracker.debian.org/pkg/node-marked-man) ([forwarded upstream](https://github.com/kapouer/marked-man/pull/32)).
* [#1030727](https://bugs.debian.org/1030727) filed against [`multipath-tools`](https://tracker.debian.org/pkg/multipath-tools).
* [#1031030](https://bugs.debian.org/1031030) filed against [`ruby-pgplot`](https://tracker.debian.org/pkg/ruby-pgplot).
* [#1031412](https://bugs.debian.org/1031412) filed against [`pysdl2`](https://tracker.debian.org/pkg/pysdl2).
@@ -178,16 +177,16 @@ The Reproducible Builds project detects, dissects and attempts to fix as many cu
The Reproducible Builds project operates a comprehensive testing framework (available at [tests.reproducible-builds.org](https://tests.reproducible-builds.org)) in order to check packages and other artifacts for reproducibility. In February, the following changes were made by Holger Levsen:
* Add three new [OSUOSL](https://osuosl.org/) nodes [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/d188805b)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/f9f9c65d)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/f57dbeb1)] and decommission the `osuosl174` node [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/f05f9ce7)].
-* Change the order of listed Debian architectures to show the 64-bit ones first. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/0b65129f)]
-* Reduce the frequency that the Debian package sets and `dd-list` HTML pages update. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/965b4358)]
-* Sort "Tested suite" consistently (and Debian *unstable*) first. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/6503fafd)]
+* Change the order of listed Debian architectures to show the 64-bit ones first [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/0b65129f)].
+* Reduce the frequency that the Debian package sets and `dd-list` HTML pages update [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/965b4358)].
+* Sort "Tested suite" consistently (and Debian *unstable*) first [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/6503fafd)].
* Updated the Jenkins shell monitor script to only query disk statistics every 230min [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/7eafae2d)] and improve the documentation [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/5ed88c03)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/8d882964)].
---
## Other development work
-[*disorderfs*](https://salsa.debian.org/reproducible-builds/disorderfs) version `0.5.11-3` was uploaded by Holger Levsen, fixing a number of issues with the manual page. [[...](https://salsa.debian.org/reproducible-builds/disorderfs/commit/2c3df22)][[...](https://salsa.debian.org/reproducible-builds/disorderfs/commit/e92c9c2)][[...](https://salsa.debian.org/reproducible-builds/disorderfs/commit/76c9e78)]
+[*disorderfs*](https://salsa.debian.org/reproducible-builds/disorderfs) version `0.5.11-3` was uploaded by Holger Levsen, fixing a number of issues with the manual page [[...](https://salsa.debian.org/reproducible-builds/disorderfs/commit/2c3df22)][[...](https://salsa.debian.org/reproducible-builds/disorderfs/commit/e92c9c2)][[...](https://salsa.debian.org/reproducible-builds/disorderfs/commit/76c9e78)].
<br>
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/fb7c120e83e13349cb8cfee3acf5e4c04bf9cf62
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/fb7c120e83e13349cb8cfee3acf5e4c04bf9cf62
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-commits/attachments/20230304/3788eb95/attachment.htm>
More information about the rb-commits
mailing list