Two questions about build-path reproducibility in Debian

[Richard Purdie]

On Wed, 2024-03-06 at 14:57 +0000, Holger Levsen wrote:
> On Tue, Mar 05, 2024 at 11:51:16PM +0000, Richard Purdie wrote:
> > FWIW Yocto Project is a strong believer in build reproducibiity
> > independent of build path and we've been quietly chipping away at
> > those
> > issues.
> [...] 
> > OpenEmbedded-Core (around 1000 pieces of software) is 100%
> > reproducible
> > and we have the tests to prove it running daily, building in
> > different
> > build paths and comparing the output.
> 
> that's awesome!
> 
> btw, https://www.yoctoproject.org/reproducible-build-results/ (linked
> from https://reproducible-builds.org/who/projects/#Yocto%20Project)
> doesn't show any results?

We made changes to the website and that stopped working. We had noticed
and raised it with the website people but I've used your question to
encourage them to get it fixed :).

It now shows "36754 out of 36754 (100.00%) packages tested were
reproducible" :)

The tests were always running, the webpage was just broken.

> > We're working on our wider layers too, e.g. meta-openembedded has
> > another 2000+ pieces of software and less than 100 are not
> > reproducible.
> 
> nice.
> 
> we had 35000 pieces of software in Debian of which ~2000 were not 
> reproducible with undeterministic build pathes. Now with build pathes
> as part of the build environment it's less than half.

Very nice too! :)

FWIW we've made reproducibility an unconditional thing in our
configuration and processes now so everyone sees the common errors and
we're all using the same build command lines and so on.

The idea behind getting meta-openembedded tested was to ensure (and
demonstrate) our tools and tests could be used against arbitrary layers
which should encourage people to test their own software.

Lots of small steps which should help the overall ecosystem and goal.

Cheers,

Richard