Help us map the reproducible builds ecosystem

[Richard Purdie]

On Thu, 2021-08-05 at 14:38 +0000, Holger Levsen wrote:
> On Thu, Aug 05, 2021 at 02:51:17PM +0100, Chris Lamb wrote:
> > There is definitely an argument to be as complete as possible, but I
> > think the best thing from the perspective of the ecosystem map is to
> > be as consistent as possible across similar entities.
> 
> I'm not sure there is so much consistancy...
>  
> 
> > Therefore we should _probably_ stick to "% reproducible of packages",
> > as this is a number that most, if not all, distributions have.
> 
> tails doesnt have any packages, nor yocto, and the java world has artifacts

For yocto, we can generate packages and we do run tests of our default config 
on those:

https://www.yoctoproject.org/reproducible-build-results/

so 36 exclusions (known issues, effectively golang) of 34170 packages.

This is for our core layer only though.  There are many layers/configurations 
and our aim is to provide the tools and configurations that let anyone build 
something which is reproducible and prove that though testing themselves. We 
therefore use our core test as an indication that we can build reproducible 
things and that our testing process works.


>From Yocto, this then feeds into Linux distros from our members/users like 
Wind River, Montavista, ENEA, Automotive Grade Linux (AGL), OpenBMC and
many other projects, some we know, many we don't. An example end result would
be reproducible binaries in your car, aeroplane and TV :)

Not sure how that looks on your map! We struggle a lot to know where Yocto
ends up too.

FWIW we've been trying to get people to add known users to
https://wiki.yoctoproject.org/wiki/Project_Users but that is ongoing and
currently far from being even remotely complete.

Cheers,

Richard