How to Add a New Project within Reproducible Builds

Wed Nov 9 19:35:33 UTC 2022

(had a snafu signing up with rb-general, so I’ve manually pasted responses from the Archive into this thread)

Thanks Morten and Chris!

>I believe you can just send a merge request with your changes to this repository: https://salsa.debian.org/reproducible-builds/reproducible-website

We’ll definitely start looking to submit a merge request in the near future!

>What project is Microsoft intending to add to Reproducible Builds?

We’re looking to submit .NET SDK. For all of our core scenarios this is a fully reproducible toolset. This is true out of the box with no real configuration changes needed. There is one caveat though: some less mainline scenarios are not reproducible at the moment (e.g. AOT). I’ve added Jared Parsons to this thread who is the lead engineer (and has also joined the rb-general list) and can answer any follow-up questions.

Thanks,

Adrian Diglio | Principal PM Manager
Secure Software Supply Chain (S3C)
CISSP | Security+ | PMP | GCED | OSWP
[cid:image001.png at 01D8F394.2AFFDBB0]
One Microsoft Way | Redmond, WA 98052
Office: +1 (425) 703-0085
[cid:image002.jpg at 01D8F394.2AFFDBB0]

Hi Adrian,

I just want to briefly +1 or otherwise confirm a couple of things that

Morten already said.

> There is a meeting once a month on IRC, but how the Reproducible Builds effort

> works is less organized and more as a collaborative umbrella between different

> projects.

Indeed, our project is much more of a distributed meeting house for

all things related to reproducibility than anything else: it tries not

to have a top-down organisational structure and, because of the

diverse interests the project attracts, it can't have strict or

inflexible targets and goals either.

>> I'm inquiring to understand what the process is for joining and/or adding a

>> new project under the Project page of Reproducible-Builds.org Who is involved?

>> - reproducible-builds.org<https://reproducible-builds.org/who/projects/>?

>

> I believe you can just send a merge request with your changes to this

> repository:

> https://salsa.debian.org/reproducible-builds/reproducible-website

Morten is right: assuming that your project is indeed related to

reproducibility, we'd be more than happy to add you to this page. As

alluded to in my previous paragraph, there is no formal onboarding

process for new projects like there might be for, say, a foundation.

Integrating with our continuous integration system is a different

question though, and one a bit more technical in nature. It may not

make sense to do this depending on the nature of your project: in

general, our CI system is testing various package repositories rather

than testing individual projects.

But yes, perhaps if you could describe your project in a few more

details, that would help us help you better. Either way though,

welcome to the list. :)

Best wishes,

--

      o

    ⬋   ⬊      Chris Lamb

   o     o     reproducible-builds.org 💠

    ⬊   ⬋

      o

>

> Hello!

Yo!

> Can someone please help me better understand the onboarding process and

> requirements for joining reproducible-builds as a new project? I'd like to

> learn more about how to engage with the community, and potentially how to add

> a new project.

The reason why you have had trouble getting any response the past few days is

because there is a summit in Venice happening this week :)

https://reproducible-builds.org/events/venice2022/

There is a meeting once a month on IRC, but how the Reproducible Builds effort

works is less organized and more as a collaborative umbrella between different

projects.

> I'm inquiring to understand what the process is for joining and/or adding a

> new project under the Project page of Reproducible-Builds.org Who is involved?

> - reproducible-builds.org<https://reproducible-builds.org/who/projects/>?

I believe you can just send a merge request with your changes to this

repository:

https://salsa.debian.org/reproducible-builds/reproducible-website

> When adding a new project to reproducible-builds.org, I'm sure there's also

> additional steps that would be required of us, such as documentation etc. Is

> there anything in particular that is required to be added to your Continuous

> Tests? Anything to help me understand your onboarding process would be great.

Not really. As mentioned previously this is a lot of work by volunteers, thus

natually less structured. Nothing is really required and a lot of the work is

done on a best-effort basis.

What project is Microsoft intending to add to Reproducible Builds?

--

Morten Linderud

PGP: 9C02FF419FECBE16

From: Adrian Diglio
Sent: Friday, November 4, 2022 6:21 PM
To: contact at reproducible-builds.org; rb-general at lists.reproducible-builds.org
Subject: RE: How to Add a New Project within Reproducible Builds

(Expanding audience)

Hello!

Can someone please help me better understand the onboarding process and requirements for joining reproducible-builds as a new project? I’d like to learn more about how to engage with the community, and potentially how to add a new project.

I’ve already requested to join the mailing list and the Salsa project on GitLab.

Thanks,

Adrian Diglio | Principal PM Manager
Secure Software Supply Chain (S3C)
CISSP | Security+ | PMP | GCED | OSWP
[cid:image001.png at 01D8F394.2AFFDBB0]
One Microsoft Way | Redmond, WA 98052
Office: +1 (425) 703-0085
[cid:image002.jpg at 01D8F394.2AFFDBB0]

From: Adrian Diglio
Sent: Tuesday, November 1, 2022 9:50 PM
To: contact at reproducible-builds.org<mailto:contact at reproducible-builds.org>
Subject: How to Add a New Project within Reproducible Builds

Hello Core Team,

I’m inquiring to understand what the process is for joining and/or adding a new project under the Project page of Reproducible-Builds.org Who is involved? — reproducible-builds.org<https://reproducible-builds.org/who/projects/>?

My apologies in advance if this is simple and I failed to find it in your docs. Do we just create a new account in Salsa via How to join the Salsa group — reproducible-builds.org<https://reproducible-builds.org/contribute/salsa/>? Or do we need to become members of Project Membership in Software Freedom Conservancy (sfconservancy.org)<https://sfconservancy.org/projects/>? Any help you can provide to point me in the right direction would be greatly appreciated.

When adding a new project to reproducible-builds.org, I’m sure there’s also additional steps that would be required of us, such as documentation etc. Is there anything in particular that is required to be added to your Continuous Tests? Anything to help me understand your onboarding process would be great.

Thank you very much,

Adrian Diglio | Principal PM Manager
Secure Software Supply Chain (S3C)
CISSP | Security+ | PMP | GCED | OSWP
[cid:image001.png at 01D8F394.2AFFDBB0]
One Microsoft Way | Redmond, WA 98052
Office: +1 (425) 703-0085
[cid:image002.jpg at 01D8F394.2AFFDBB0]

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-general/attachments/20221109/e8d94d09/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 7242 bytes
Desc: image001.png
URL: <http://lists.reproducible-builds.org/pipermail/rb-general/attachments/20221109/e8d94d09/attachment.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.jpg
Type: image/jpeg
Size: 1375 bytes
Desc: image002.jpg
URL: <http://lists.reproducible-builds.org/pipermail/rb-general/attachments/20221109/e8d94d09/attachment.jpg>