[rb-general] Reproducible builds and distributed CI

[Holger Levsen]

Hi Lars,

besides what others have said already...

On Sun, May 19, 2019 at 01:09:40PM +0300, Lars Wirzenius wrote:
> bitwise reproducible builds are awesome. I have a question on maybe
> building on that for a distributed CI system.
[...] 
> What do you think, you who have a lot of experience with reproducible
> builds? Is there any merit in what I'm thinking? Any problems you
> foresee in relying in reproducible builds like this? Is it
> unreasonable to require random software developers to achieve
> reproducible builds?

there was a GSoC project for OpenWrt (maybe under the LEDE name back
then) which was based on a similar idea: build software updates in the
cloud and only packages which can be build reproducible on several
nodes. I *guess* one of the problems then was that important parts of
the software stack were not reproducible, thus preventing updates, which
in practice thus doesnt work. 
(Other people on this list might know more about this GSoC project.)

If you would do this for Debian, you'd face similar problems, some
important packages are simply not yet reproducible, see 

https://tests.reproducible-builds.org/debian/buster/amd64/pkg_set_build-essential-depends.html
(128 source packages unreproducible)

https://tests.reproducible-builds.org/debian/buster/amd64/pkg_set_popcon_top1337-installed-sources.html
(73 source packages unreproducible)

https://tests.reproducible-builds.org/debian/buster/amd64/pkg_set_key_packages.html
(262 source packages unreproducible)


If you "only" want to build $your packages reproducible, such a setup
could work very nicely today though!


-- 
tschau,
	Holger

-------------------------------------------------------------------------------
               holger@(debian|reproducible-builds|layer-acht).org
       PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.reproducible-builds.org/pipermail/rb-general/attachments/20190520/5df382c5/attachment.sig>