NetBSD Reproducibility Report #6

[Holger Levsen]

On Mon, Dec 09, 2024 at 12:55:23PM +0100, Jan-Benedict Glaw wrote:
> > I find it interesting, that more builds on linux are reproducible than
> > on netbsd!
> Don't know how that happened, but I'll work on getting the
> NetBSD-based builds to build reproducible as well.

:)
 
>   I don't know if it's any good to publish my tarball's checksums.
> Maybe a manifest (with checksums) of the whole release tree
> (containing kernel images, install filesystems, ...) might be useful
> to have, but that's actually already (mostly) there:

yes, such a manifest sounds like a great idea. maybe call it
buildinfo.manifest? or .buildinfo file? eg evbarm-earmv6.buildinfo?
 
> > http://toolchain.lug-owl.de/laminar/jobs/nnetbsd-mvme68k-m68k/30
> > which dont work for me with firefox (initial loading of the page is
> > fine, but as soon as I scroll I only see a white page and the tab
> > becomes unresponsive), does chromium work better?
> That's potentially a 300 MB'ish download containing a verbose build
> log; better look at that with `curl`...

ic, thanks.
 
> > & so I'm wondering: do the linux builds produce the exact same artifacts
> > as the builds on netbsd?
> When there is a "reproducibility star" in the final column (called
> "All four builds"), then the tarball containing all release artifacts
> are bit-identical for all four builds. (Getting even one all-fours is
> a great achievement, but we're already at 44, nearly half of all
> combinations, and a few of them are actually completely dead, like
> or1k, playstation2-mipsel, sgimips-mips64eb, evbcf-coldfire,
> arc-mips64el.)

wow, neato! (maybe explain that on the page too? "a star here means this,
a star there that."?!)


-- 
cheers,
	Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁  holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀  OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
 ⠈⠳⣄

So what CAN we actually do? Well, individual decisions (eating less meat,
taking public transport, buying less fast fashion) are all important, but we
also need to change the system. As you may know, just 100 companies are
responsible for 71% of global emissions. (@JessicaTheLaw)
https://www.theguardian.com/sustainable-business/2017/jul/10/100-fossil-fuel-companies-investors-responsible-71-global-emissions-cdp-study-climate-change
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.reproducible-builds.org/pipermail/rb-general/attachments/20241209/a6ec1f76/attachment.sig>