Monthly status update about reproducible live-build ISO images

[Roland Clobus]

Hello lists,

here is the 16th update of the status for reproducible live-build ISO 
images [1].

Single line summary: The live images stayed reproducible.

Reproducible status:
* All major desktops build reproducibly with bullseye, bookworm and sid
* Number of patches performed by the live-build script that are not yet 
in sid: zero! (0)
* Due to transitions, the LXQt desktop live image is occasionally not 
building due to conflicting packages

My activities in December and January:
* Modifications to live-setup
** Open MR: Images can be generated automatically [11]
** Since no snapshot server will be used, the live images are 
reproducible only for at most a 6 hour window
** More investigation is required to verify whether 2 timestamps (1 for 
the files in the image and 1 for the timestamp for accessing the 
matching snapshot) will be sufficient to provide long-term reproducibility
* Bug reports for bugs found with openQA are collected at [12]
* Preparation of improvements for the live images
** Open MR: live-installer: A better user experience after the installer 
is finished [13]
** Open MR: live-build: Various installer improvements, including 
off-line installation [15]
** Open MR: live-build: Rebuild script improvement for running with 
live-setup and Jenkins [16]
* Preparation of improvements for the Debian installer
** Open MR: localechooser: A minor fix [14] (A country was placed in the 
'other' category)
* Bug triaging:
** Open MR: Reassigned #1023472 to task-lxqt-desktop: pulls in both kwin 
& xfwm4 and wrote a patch [18]
** #1017435 got fixed in git and is pending for release [19]
** #1029393 about missing glyps in the installer [20]
* I've posted a heavily cross-posted mail, which did not elicit any 
response [17]
** As you can see above, I currently have a several open MRs pending
** The first stage of the freeze for Bookworm is active, the next one is 
coming soon

Work to be done:
* Live images are not generated officially by Debian yet
** Might need additional changes in 'live-setup'
** Needs communication to coordination the next steps
** This will be the next main target
* Update the support for non-free firmware
* More investigation is required to provide long-term reproducibility, 
because the live image will be generated without using a snapshot server
* Review the results of the generated ISO images in my local openQA instance
* Add a test for the Calamares installer in openQA
* Adjust the content of the live-build image
** Make the boot menu more similar to the live-wrapper menu
** Add a 'persistent' option (as seen in Kali)
** Keep the accessibility improvements made in the live-wrapper boot menu
** Verify the package lists
*** e.g. the Debian Reference is installed for es and it, but not en
* Bug triaging for issues reported against live-build

Unchanged, but low priority due to [5], patch available but not released 
yet:
* texlive-base: Reported differences in the generated ls-R [2]
* texlive-binaries: Randomness in .fmt files due to Lua hash seeds [3]
* texlive-binaries: updmap creates a logfile with the timestamps of 
files that it just has generated [4]
* Priority is now very low, since the package is not used in live images 
any more
** This section will be removed from my next report

With kind regards,
Roland Clobus

[1] https://wiki.debian.org/ReproducibleInstalls/LiveImages
[2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1003449
[3] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009196
[4] 
https://salsa.debian.org/live-team/live-build/-/commit/f1a98e4da62c3551f523553c6e23774aaf5e41b4
[5] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006472
[11] https://salsa.debian.org/images-team/live-setup/-/merge_requests/2
[12] 
https://udd.debian.org/cgi-bin/bts-usertags.cgi?user=debian-qa%40lists.debian.org&tag=openqa&format=html#results
[13] 
https://salsa.debian.org/installer-team/live-installer/-/merge_requests/3
[14] 
https://salsa.debian.org/installer-team/localechooser/-/merge_requests/7
[15] https://salsa.debian.org/live-team/live-build/-/merge_requests/297
[16] https://salsa.debian.org/live-team/live-build/-/merge_requests/298
[17] https://lists.debian.org/debian-devel/2023/01/msg00128.html
[18] https://salsa.debian.org/installer-team/tasksel/-/merge_requests/23
[19] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1017435
[20] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1029393
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.reproducible-builds.org/pipermail/rb-general/attachments/20230129/d5e3ebe2/attachment.sig>