Irregular status update about reproducible live-build ISO images

[Roland Clobus]

Hello lists,

here is the 23th update of the status for reproducible live-build ISO 
images [1].

Single line summary: 97.7% reproducible live images

Reproducible status:
* All major desktops build reproducibly with bullseye, bookworm, trixie 
and sid ...
** ... provided they are built for a second time within the same DAK run 
(i.e. 6 hours)
* All major desktops built reproducibly for the official Debian live 
images for bookworm (12.5.0) at any later moment ...
** ... except for KDE, which has only 1 issue left in 12.5.0
* Last month a question was raised, whether the distributed sources are 
sufficient to rebuild the images. The answer is: probably yes, but I 
haven't tried.
The chain is: source code --compiler--> executable files --debian 
packaging--> .deb archives --live-build--> live images
I've focused on the last section of this chain; the installation of the 
.deb archives into the live images.

My activities in February:
* Rebuilding all images for 12.5.0
* The KDE image in 12.4.0 had 2 sources of non-reproducibility
** Issue 1: order in the filesystem for vlc, has been worked-around for 
12.5.0 [3]. An upstream fix would need sorting of the output of 
`readdir`, which would be some copy of the code from disorderfs
** Issue 2: unstable sort in install-info, was fixed upstream [4] for 
trixie and worked-around [5] for the (future) 12.6.0 bookworm release, 
which is planned for April
* The MR for better udeb handling [2] is now merged, the installer for 
the trixie images uses DHCP again.
* Some bug triaging, closing old bug reports
* The official weekly live images are now regularly fed to openQA for 
functionality tests (in addition to the images generated by Jenkins)
* Unfinished: support for cross-builds to arm64 in the helper script 
(including documentation)
* Unfinished: pre-release work-around for #1051607 (Calamares 
installation on UEFI Secure Boot systems fails to boot after installation)

Work to be done:
* Visit to the MiniDebCamp in Hamburg [6]
* See the TODO page [7]

With kind regards,
Roland Clobus

[1] https://wiki.debian.org/ReproducibleInstalls/LiveImages
[2] https://salsa.debian.org/live-team/live-build/-/merge_requests/337
[3] https://salsa.debian.org/live-team/live-build/-/merge_requests/338
[4] 
https://git.savannah.gnu.org/cgit/texinfo.git/commit/?id=01b5a4b9c33bef08feae041c221f820a1c76749f
[5] https://salsa.debian.org/live-team/live-build/-/merge_requests/339
[6] https://wiki.debian.org/DebianEvents/de/2024/MiniDebCampHamburg
[7] https://wiki.debian.org/DebianLive/TODO

97.7%: based on 4 versions x 9 variants + 8 variants
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.reproducible-builds.org/pipermail/rb-general/attachments/20240227/2aff88ba/attachment.sig>