trying to reproduce hello-traditional from Debian. .buildinfo file? next steps?

[Carles Pina i Estany]

Hi,

On 02 Aug 2023 at 10:24:23, Vagrant Cascadian wrote:
> On 2023-08-02, Carles Pina i. Estany wrote:
> > This is Debian specific but I cannot find a reproducible builds Debian
> > specific mailing list. Let me know if I should ask elsewhere. Feel free
> > to send me some pointers to read it myself.
> 
> There is also reproducible-builds at lists.alioth.debian.org more
> specifically for Debian, although rb-general works too. We can all learn
> from the quirks of other projects. :)

I'll subscribe there for next question / get more reproducible
information :-)

> > TL;DR: I'm trying to build hello-traditional from Debian and have the
> > same result as Debian. I cannot do it. Pointers welcome. I thought of
> > using the .buildinfo file to reproduce the build environment and deps
> > but unsure of the best way and if this is the way.
> 
> Yes, you usually need to use the same packages as listed in the
> .buildinfo, and in general the same build path (tools like sbuild and
> pbuilder randomize the build path by default). Although it looks like
> hello-traditional is generally reproducible with varied build paths, so
> more likely it is just different build dependencies.

Since my question I checked the buildlogs from Debian and my test system
and the dependencies are quite different (libc6 versions, gcc, etc.)
("quite different": the ones from December 2022 VS. now)

> It is sometimes possible to get bit-for-bit identical results even with
> some variations in the build-dependencies, but it is not expected. More
> like a happy fluke of luck. :)

I'm sometimes lucky but not this time! (but at least I digged a bit more
and found interesting things on the way... so perhaps I was lucky :-) )

[...]

> > And my question is: how to achieve the same Build ID?
> >
> > I thought of using the .buildinfo file from:
> > https://tests.reproducible-builds.org/debian/buildinfo/bookworm/amd64/hello-traditional_2.10-6_amd64.buildinfo
> >
> > But I'm not sure what is the best way (besides installing the same exact
> > packages in the schroot and setting the Environment) to do it. And I'm
> > not sure that this is the way to go anyway, tool that might exist, etc.
> 
> There is some tooling to try to reproduce the exact build environment,

Do you have a URL or naming of the tooling to give a try?

> although it is somewhat hindered by issues with snapshot.debian.org. If
> you're lucky, you might get it to work. There is a work-in-progress
> replacement, but I am not sure of the status at this moment.

If you have URLs or names let me know. Yesterday I was trying to find it
and didn't find it. I'll give a try with an idea with Debian snapshot
but I don't want to re-invent the tooling again :-)

Thanks very much all!

-- 
Carles Pina i Estany
https://carles.pina.cat || Wiktionary translations: https://kamus.pina.cat