Irregular status update about reproducible live-build ISO images

[Roland Clobus]

Hello lists,

here is the 20th update of the status for reproducible live-build ISO 
images [1].

Single line summary: I'm nearly there [2]

Reproducible status:
* All major desktops build reproducibly with bullseye, bookworm, trixie 
and sid ...
** ... provided they are built for a second time within the same DAK run 
(i.e. 6 hours)
* Rebuilding the official bookworm images (standard and gnome) for 
12.2.0 at any later moment
** Only 1 timestamp causes differences in the ISO images
** The source tarball has a random order, but identical content
** A downgrade of debootstrap to 1.0.128+nmu2 on the host is required
* The other official bookworm images for 12.2.0 have not been evaluated yet

Functionality status:
* The sid images are affected by #1051607 (Calamares installation on 
UEFI Secure Boot systems fails to boot after installation)
* The sid images occasionally report missing installation media, when 
booting from USB in UEFI non-secure boot systems
* The LXQT sid image needs some adjustments in openQA

Transient building issue:
* sid is waiting for the nmu of libalien-wxwidgets-perl
** Currently the dependency-chain cannot be resolved in sid
** But sid isn't called unstable for no reason...

My activities in September, October:
* libarchive outputs the same order as isoinfo [3]
* The manual for jenkins.d.n was updated for openQA [4]
* live-build: Removed cached files from appstream [5]
* Minor updates to the openQA tests of the live images
* Preliminary (local) tests to make the live images support FST (File 
System Transposition), prompted by [6]
** This will make any USB stick bootable on UEFI systems when the files 
of the live image are copied, eliminating the need for dd
* Some (local) experiments to make the available languages in the live 
images more visible [7]

Work to be done:
* Test the official images and regular snapshot images in openQA as well 
as the images generated by Jenkins (possibly replacing the images 
generated by Jenkins)
* Review the results of the generated ISO images in my local openQA instance
* Adjust the content of the live-build image
** Fix the few remaining reproducible issues in time before 12.3.0 
(planned for early December 2023)
* Many other things. Moved to the TODO page [10]

With kind regards,
Roland Clobus

[1] https://wiki.debian.org/ReproducibleInstalls/LiveImages
[2] I once wrote that the images are reproducible, but then I tried the 
long-term reproducibility...
[3] https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/350
[4] 
https://salsa.debian.org/rclobus-guest/jenkins.debian.net/-/commit/8aea639adbeee94c5099c602569109284203f985
[5] 
https://salsa.debian.org/live-team/live-build/-/commit/d70a84f2e9f6808ca24a52cee1ec62898de98db0
[6] https://salsa.debian.org/live-team/live-build/-/merge_requests/323
[7] https://lists.debian.org/debian-live/2023/09/msg00014.html
[8] 
https://bugs.debian.org/cgi-bin/pkgreport.cgi?archive=0;dist=unstable;ordering=normal;repeatmerged=0;src=live-build
[9] https://bugs.debian.org/cgi-bin/pkgreport.cgi?package=debian-live
[10] https://wiki.debian.org/DebianLive/TODO
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.reproducible-builds.org/pipermail/rb-general/attachments/20231018/c5919361/attachment.sig>