Reproducible Builds in December 2024
Chris Lamb
chris at reproducible-builds.org
Thu Jan 9 12:22:13 UTC 2025
--------------------------------------------------------------------
o
⬋ ⬊ December 2024 in Reproducible Builds
o o
⬊ ⬋ https://reproducible-builds.org/reports/2024-12/
o
--------------------------------------------------------------------
Welcome to the December 2024 report from the Reproducible Builds
project!
Our monthly reports outline what we've been up to over the past month
and highlight items of news from elsewhere in the world of software
supply-chain security where relevant. As ever, if you are interested
in contributing to the Reproducible Builds project, please visit the
Contribute [0] page on our website.
§
Table of contents:
* reproduce.debian.net
* debian-repro-status
* On our mailing list
* "Enhancing the Security of Software Supply Chains"
* diffoscope
* Supply-chain attack in the Solana ecosystem
* Website updates
* Debian changes
* Other development news
* Upstream patches
* Reproducibility testing framework
[1] https://reproducible-builds.org/contribute/
§
reproduce.debian.net
--------------------
Last month saw the introduction of reproduce.debian.net [3].
Announced at the recent Debian MiniDebConf in Toulouse [4],
reproduce.debian.net is an instance of rebuilderd [5] operated by the
Reproducible Builds project. rebuilderd is our server designed monitor
the official package repositories of Linux distributions and attempts
to reproduce the observed results there.
This month, however, we are pleased to announce that not only does the
service now produce graphs [6], the reproduce.debian.net [7] homepage
itself has become a "start page" of sorts, and the
amd64.reproduce.debian.net [8] and i386.reproduce.debian.net [9] pages
have emerged. The first of these rebuilds the amd64 architecture,
naturally, but it also is building Debian packages that are marked
with the 'no architecture' label, all. The second builder is, however,
only rebuilding the i386 architecture.
Both of these services were also switched to reproduce the Debian
'trixie' distribution instead of 'unstable', which started with 43% of
the archive rebuild with 79.3% reproduced successfully. This is very
much a work in progress, and we'll start reproducing Debian unstable
soon.
Our i386 hosts are very kindly sponsored by Infomaniak [10] whilst the
amd64 node is sponsored by OSUOSL [11] — thank you! Indeed, we are
looking for more workers for more Debian architectures; please contact
us if you are able to help.
[3] https://reproduce.debian.net
[4] https://toulouse2024.mini.debconf.org/
[5] https://github.com/kpcyrd/rebuilderd
[6] https://amd64.reproduce.debian.net/stats/rb.png
[7] https://reproduce.debian.net/
[8] https://amd64.reproduce.debian.net
[9] https://i386.reproduce.debian.net
[10] https://www.infomaniak.com/en
[11] https://osuosl.org
§
debian-repro-status
-------------------
Reproducible builds developer kpcyrd has published a client program
for reproduce.debian.net [12] (see above) that queries the status of
the locally installed packages and rates the system with a
percentage score. This tool works analogously to arch-repro-status
[13] for the Arch Linux [14] Reproducible Builds setup.
The tool was packaged for Debian and is currently available in Debian
trixie [15] and it can be installed with apt install debian-repro-status.
[12] https://github.com/kpcyrd/debian-repro-status
[13] https://gitlab.archlinux.org/archlinux/arch-repro-status
[14] https://archlinux.org/
[15] https://packages.debian.org/trixie/debian-repro-status
§
On our mailing list
-------------------
On our mailing list this month:
* Bernhard M. Wiedemann wrote a detailed post [17] on his "long journey
towards a bit-reproducible Emacs [18] package." In his interesting
message, Bernhard goes into depth about the tools that they used and
the lower-level technical details of, for instance, compatibility
with the version for glibc [19] within openSUSE.
[17] https://lists.reproducible-builds.org/pipermail/rb-general/2024-December/003612.html
[18] https://www.gnu.org/software/emacs/
[19] https://www.gnu.org/software/libc/
* Shivanand Kunijadar posed a question [20] pertaining to the
reproducibility issues with encrypted images. Shivanand explains that
they must "use a random IV for encryption with AES CBC. The resulting
artifact is not reproducible due to the random IV used." The message
resulted in a handful of replies [21], hopefully helpful!
[20] https://lists.reproducible-builds.org/pipermail/rb-general/2024-December/003613.html
[21] https://lists.reproducible-builds.org/pipermail/rb-general/2024-December/thread.html#3613
* User Danilo posted an in interesting question related to their
attempts in trying to achieve reproducible builds [22] for Threema
Desktop 2.0 [23]. The question resulted in a number of replies
attempting to find the right combination of compiler and linker flags
(for example [24]).
[22] https://lists.reproducible-builds.org/pipermail/rb-general/2024-December/003592.html
[23] https://three.ma/md
[24] https://htmlpreview.github.io/?https://raw.githubusercontent.com/openjdk/jdk/master/doc/building.html#cross-compiling-the-easy-way
* Longstanding contributor David A. Wheeler [25] wrote to our list
announcing the release of the "Census III of Free and Open Source
Software: Application Libraries [26]" report written by Frank Nagle,
Kate Powell, Richie Zitomer and David himself. As David writes in his
message [27], the report attempts to "answer the question 'what is
the most popular Free and Open Source Software (FOSS)?'".
[25] https://dwheeler.com
[26] https://www.linuxfoundation.org/research/census-iii
[27] https://lists.reproducible-builds.org/pipermail/rb-general/2024-December/003604.html
* Lastly, kpcyrd followed-up to a post from September 2024 [28] which
mentioned their desire for "someone" to implement "a hashset of
allowed module hashes that is generated during the kernel build and
then embedded in the kernel image", thus enabling a deterministic and
reproducible build. However, they are now reporting that "somebody
implemented the hash-based allow list feature and submitted it to the
Linux kernel mailing list [29]". Like kpcyrd, we hope it
gets merged.
[28] https://lists.reproducible-builds.org/pipermail/rb-general/2024-September/003530.html
[29] https://lore.kernel.org/lkml/20241225-module-hashes-v1-0-d710ce7a3fd1@weissschuh.net/
§
"Enhancing the Security of Software Supply Chains: Methods and Practices"
-------------------------------------------------------------------------
Mehdi Keshani of the Delft University of Technology [30] in the
Netherlands has published their thesis on "Enhancing the Security of
Software Supply Chains: Methods and Practices". Their introductory
summary first begins with an outline of software supply chains and the
importance of the Maven [31] ecosystem before outlining the issues that
it faces "that threaten its security and effectiveness". To
address these:
> First, we propose an automated approach for library reproducibility
> to enhance library security during the deployment phase. We then
> develop a scalable call graph generation technique to support
> various use cases, such as method-level vulnerability analysis and
> change impact analysis, which help mitigate security challenges
> within the ecosystem. Utilizing the generated call graphs, we
> explore the impact of libraries on their users. Finally, through
> empirical research and mining techniques, we investigate the current
> state of the Maven ecosystem, identify harmful practices, and
> propose recommendations to address them.
A PDF of Mehdi's entire thesis [32] is available to download.
[30] https://www.tudelft.nl/en/
[31] https://maven.apache.org/
[32] https://research.tudelft.nl/files/221939594/mehdi-keshani-thesis-24092024.pdf
§
diffoscope
----------
diffoscope [34] is our in-depth and content-aware diff utility that can
locate and diagnose reproducibility issues. This month, Chris Lamb made
the following changes, including preparing and uploading versions 283
and 284 to Debian:
* Update copyright years. [35]
* Update tests to support file 5.46. [36][37]
* Simplify tests_quines.py::test_{differences,differences_deb} to
simply use assert_diff and not mangle the test fixture. [38]
[34] https://diffoscope.org
[35] https://salsa.debian.org/reproducible-builds/diffoscope/commit/d6868b26
[36] https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/395
[37] https://salsa.debian.org/reproducible-builds/diffoscope/commit/06f00adc
[38] https://salsa.debian.org/reproducible-builds/diffoscope/commit/fef20236
§
Supply-chain attack in the Solana ecosystem
-------------------------------------------
A significant supply-chain attack impacted Solana [39], an ecosystem for
decentralised applications running on a blockchain.
Hackers targeted the @solana/web3.js [40] JavaScript library and
embedded malicious code that extracted private keys and drained funds
from cryptocurrency wallets. According to some reports, about $160,000
worth of assets [41] were stolen, not including SOL tokens and other
crypto assets.
[39] https://solana.com/
[40] https://solana-labs.github.io/solana-web3.js/
[41] https://solscan.io/account/FnvLGtucz4E1ppJHRTev6Qv4X7g8Pw6WPStHCcbAKbfx#portfolio
§
Website updates
---------------
Similar to last month, there was a large number of changes made to our
website this month, including:
* Chris Lamb:
* Make the landing page hero look nicer when the vertical height
component of the viewport is restricted, not just the
horizontal width.
* Rename the "Buy-in" page to "Why Reproducible Builds?" [42]
* Removing the top black border. [43][44]
[42] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/00394872
[43] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/506f967a
[44] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/67afffed
* Holger Levsen:
* Fixed a number of issues on the 2024 Summit page [45], including
fixing the path to a sponsor logo [46] but also added the event
documentation from Aspiration [47].
* Check and cleanup a presentation formerly linked from the "About
[48]" page on the Debian wiki [49]. [50]
* Link to reproduce.debian.net [51] on the "Involved Projects" [52]
page. [53]
* Fix a number of links on the "Talks & Resources" [54]
page. [55][56][57][58]
[45] https://reproducible-builds.org/events/hamburg2024/
[46] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/c6779ee3
[47] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/c9ceae8a
[48] https://wiki.debian.org/ReproducibleBuilds/About
[49] https://wiki.debian.org
[50] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/05b582a5
[51] https://reproduce.debian.net
[52] https://reproducible-builds.org/who/projects/
[53] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/8bc208f1
[54] https://reproducible-builds.org/resources/
[55] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/dc9d316e
[56] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/1102a72b
[57] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/0a5a3c78
[58] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/8d13c232
* 'hulkoba':
* Remove the sidebar-type layout and move to a static navigation
element. [59][60][61][62]
* Create and merge a new "Success stories" [63] page, which
"highlights the success stories of Reproducible Builds,
showcasing real-world examples of projects shipping with
verifiable, reproducible builds. These stories aim to enhance the
technical resilience of the initiative by encouraging community
involvement and inspiring new contributions.". [64]
* Further changes to the homepage [65]. [66]
* Remove the translation icon from the navigation bar. [67]
* Remove unused CSS styles pertaining to the sidebar. [68]
* Add sponsors to the global footer. [69]
* Add extra space on large screens on the "Who" [70] page. [71]
* Hide the side navigation on small screens on the "Documentation"
[72] pages. [73]
[59] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/eb1e683d
[60] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/0278825e
[61] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/7b7f171c
[62] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/1cd28b2e
[63] https://reproducible-builds.org/success-stories/
[64] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/de89a0ee
[65] https://reproducible-builds.org/
[66] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/8a9ebfee
[67] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/f5858eb3
[68] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/2d83cdd7
[69] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/c34d2a27
[70] https://reproducible-builds.org/who/
[71] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/6cb760ce
[72] https://reproducible-builds.org/docs/
[73] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/867f51dd
§
Debian changes
--------------
There were a significant number of reproducibility-related changes
within Debian [74] this month, including:
* Santiago Vila uploaded version 0.11+nmu4 of the dh-buildinfo [75]
package. In this release, the dh_buildinfo becomes a no-op — ie. it
no longer does anything beyond warning the developer that the dh-
buildinfo package is now obsolete. In his upload, Santiago wrote that
"We still want packages to drop their [dependency] on dh-buildinfo,
but now they will immediately benefit from this change after a
simple rebuild."
[74] https://www.debian.org/
[75] https://tracker.debian.org/news/1591701/accepted-dh-buildinfo-011nmu4-source-into-unstable/
* Holger Levsen filed Debian bug #1091550 [76] requesting a rebuild of
a number of packages that were built with a "very old version"
of dpkg.
* Fay Stegerman contributed to an extensive thread on the debian-devel
[77] development mailing list on the topic of "Supporting alternative
zlib implementations" [78]. In particular, Fay wrote about her
results experimenting whether zlib-ng [79] produces identical results
or not.
[76] https://bugs.debian.org/1091550
* kpcyrd uploaded a new rust-rebuilderd-worker [80], rust-derp [81],
rust-in-toto [82] and debian-repro-status [83] to Debian, which
passed successfully through the so-called NEW queue [84].
[77] https://lists.debian.org/debian-devel/
[78] https://lists.debian.org/debian-devel/2024/12/msg00356.html
[79] https://github.com/zlib-ng/zlib-ng
[80] https://tracker.debian.org/pkg/rust-rebuilderd-worker
[81] https://tracker.debian.org/pkg/rust-derp
[82] https://tracker.debian.org/pkg/rust-in-toto
[83] https://tracker.debian.org/pkg/rust-debian-repro-status
[84] https://wiki.debian.org/NewQueue
* Gioele Barabucci filed a number of bugs against the debrebuild
component/script of the devscripts [85] package, including:
* #1089087 [86]: Address a spurious extra subdirectory in the
build path.
* #1089201 [87]: Extra zero bytes added to .dynstr when rebuilding
CMake [88] projects.
* #1089088 [89]: Some binNMUs have a 1-second offset in
some timestamps.
[85] https://tracker.debian.org/pkg/devscripts
[86] https://bugs.debian.org/1089087
[87] https://bugs.debian.org/1089201
[88] https://cmake.org/
[89] https://bugs.debian.org/1089088
* Gioele Barabucci also filed a bug against the dh-r [90] package to
report that the Recommends and Suggests fields are missing from
rebuilt R packages. At the time of writing, this bug has no patch and
needs some help to make over 350 binary packages reproducible.
[90] https://tracker.debian.org/pkg/dh-r
* Lastly, 8 reviews of Debian packages were added, 11 were updated and
11 were removed this month adding to our knowledge about identified
issues [91].
[91] https://tests.reproducible-builds.org/debian/index_issues.html
§
Other development news
----------------------
In other ecosystem and distribution news:
* Jan-Benedict Glaw published the 6th NetBSD Reproducibility Report
[92] and reported on our mailing list [93] as well.
[92] http://toolchain.lug-owl.de/reports/netbsd-reproducibility-overview-6.html
[93] https://lists.reproducible-builds.org/pipermail/rb-general/2024-December/003606.html
* Developer unmush wrote a long post on the GNU Guix blog [94] on the
topic of "Adding a fully-bootstrapped Mono" [95] to the
distribution.
[94] https://guix.gnu.org/en/blog/
[95] https://guix.gnu.org/en/blog/2024/adding-a-fully-bootstrapped-mono/
* The Glasgow Haskell Compiler [96] (GHC) has released a new version of
their compiler [97]. This release introduces a new experimental flag,
-fobject-determinism [98], which enables "deterministic object
code generation".
[96] https://www.haskell.org/ghc/
[97] https://blog.haskell.org/ghc-9-12-cabal-3-14/
[98] https://downloads.haskell.org/ghc/9.12.1/docs/users_guide/using-optimisation.html#ghc-flag-fobject-determinism
* The IzzyOnDroid [99] Android APK repository published an extensive
"Review of 2024 and Outlook for 2025" [100] which includes
statistics and future plans related to reproducible builds (including
having passed the 30% mark this month).
[99] https://apt.izzysoft.de/fdroid/
[100] https://android.izzysoft.de/articles/named/review-2024-outlook-2025
* The historic Arch Linux [101] reproducibility tests that were hosted
at tests.reproducible-builds.org/archlinux now redirect to
reproducible.archlinux.org [102] instead. In fact, everything Arch-
related has now been removed from the jenkins.debian.net.git
repository, as those continuous integration tests have been disabled
for some time.
[101] https://archlinux.org/
[102] https://reproducible.archlinux.org/
* reprotest version 0.7.29 was uploaded to Debian unstable [103] by
Vagrant Cascadian. It included contributions already covered in
previous months [104] as well as new ones from Rebecca N. Palmer,
such as:
* Stop using pkg_resources. [105][106]
* The as_file attribute is not a method. [107]
* Use a non-constant object to test memory address capture. [108]
[103] https://tracker.debian.org/news/1597407/accepted-reprotest-0729-source-into-unstable/
[104] https://salsa.debian.org/reproducible-builds/reprotest/commits/debian/0.7.29
[105] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1083743
[106] https://salsa.debian.org/reproducible-builds/reprotest/commit/ef549aa
[107] https://salsa.debian.org/reproducible-builds/reprotest/commit/8e3b98a
[108] https://salsa.debian.org/reproducible-builds/reprotest/commit/690daaf
* rebuilderd was updated as follows by kpcyrd:
* Migrate diesel dependency from 1.x to 2.x. [109]
* Migrate clap dependency from 2 to 4. [110]
* Refactor reqwest code, and the replace openssl dependency with
the memory-safe rustls. [111][112]
[109] https://github.com/kpcyrd/rebuilderd/commit/970d0187
[110] https://github.com/kpcyrd/rebuilderd/commit/678ef58b
[111] https://github.com/kpcyrd/rebuilderd/commit/6ad7c33c
[112] https://github.com/kpcyrd/rebuilderd/commit/74ec1f3c
* Lastly, in openSUSE [113], Bernhard M. Wiedemann published another
report [114] for the distribution. There, Bernhard reports about the
success of building 'R-B-OS [115]', a partial fork of openSUSE with
only 100% bit-reproducible packages. This effort was sponsored by the
NLNet NGI0 [116] initiative.
[113] https://www.opensuse.org/
[114] https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/BKMFGPNWUCNLKZOWPA7GGKBERJBS4WN6/
[115] https://en.opensuse.org/openSUSE:Reproducible_openSUSE/Part1
[116] https://nlnet.nl/NGI0/
§
Upstream patches
----------------
The Reproducible Builds project detects, dissects and attempts to fix as
many currently-unreproducible packages as possible. We endeavour to send
all of our patches upstream where appropriate. This month, we wrote a
large number of such patches, including:
* Bernhard M. Wiedemann: cargo-packaging/rusty_v8 [117], cockpit [118],
collectd [119], deepin-daemon [120], deepin-file-manager [121],
esbuild [122], grpc [123], hyperkitty [124], icedtea-web [125], java-
atk-wrapper [126], kdenetwork-filesharing [127], kicad [128], kompare
[129], librespeed-cli [130], lincity-ng [131], mraa [132], ollama
[133], opa-fmgui [134], opencryptoki [135], opencryptoki [136],
openmpi4:gnu-hpc [137], openwsman [138], patterns-microos [139],
portmidi [140], presage [141], procps [142], sad [143], scons/nst
[144], sendmail [145], static-initrd [146], suse-hpc [147], swtpm
[148], tiny [149], vtk [150], xdg-desktop-portal [151] and
yast [152].
[117] https://build.opensuse.org/request/show/1233216
[118] https://github.com/cockpit-project/cockpit/pull/21460
[119] https://build.opensuse.org/request/show/1231851
[120] https://build.opensuse.org/request/show/1230049
[121] https://build.opensuse.org/request/show/1230061
[122] https://bugzilla.opensuse.org/show_bug.cgi?id=1234374
[123] https://bugzilla.opensuse.org/show_bug.cgi?id=1234751
[124] https://gitlab.com/mailman/hyperkitty/-/merge_requests/656
[125] https://build.opensuse.org/request/show/1227576
[126] https://build.opensuse.org/request/show/1230638
[127] https://build.opensuse.org/request/show/1233853
[128] https://gitlab.com/kicad/code/kicad/-/merge_requests/2087
[129] https://build.opensuse.org/request/show/1233852
[130] https://build.opensuse.org/request/show/1233732
[131] https://build.opensuse.org/request/show/1233633
[132] https://build.opensuse.org/request/show/1229658
[133] https://build.opensuse.org/request/show/1230608
[134] https://build.opensuse.org/request/show/1230004
[135] https://github.com/opencryptoki/opencryptoki/pull/828
[136] https://github.com/opencryptoki/opencryptoki/pull/832
[137] https://bugzilla.opensuse.org/show_bug.cgi?id=1234014
[138] https://build.opensuse.org/request/show/1228990
[139] https://build.opensuse.org/request/show/1233574
[140] https://build.opensuse.org/request/show/1230001
[141] https://build.opensuse.org/request/show/1233892
[142] https://gitlab.com/procps-ng/procps/-/issues/362
[143] https://github.com/ms-jpq/sad/issues/359
[144] https://build.opensuse.org/request/show/1230042
[145] https://bugzilla.opensuse.org/show_bug.cgi?id=1234629
[146] https://build.opensuse.org/request/show/1232164
[147] https://github.com/openSUSE/hpc/pull/12
[148] https://build.opensuse.org/request/show/1229015
[149] https://github.com/osa1/tiny/issues/437
[150] https://build.opensuse.org/request/show/1231633
[151] https://build.opensuse.org/request/show/1234111
[152] https://github.com/yast/yast-storage-ng/pull/1397
* Chris Lamb:
* #1089011 [153] filed against pyorbital [154].
* #1089095 [155] filed against python-pbcore [156].
[153] https://bugs.debian.org/1089011
[154] https://tracker.debian.org/pkg/pyorbital
[155] https://bugs.debian.org/1089095
[156] https://tracker.debian.org/pkg/python-pbcore
* Gioele Barabucci:
* #1089088 [157] filed against sbuild [158].
[157] https://bugs.debian.org/1089088
[158] https://tracker.debian.org/pkg/sbuild
* James Addison:
* #1090395 [159] filed against binutils [160].
[159] https://bugs.debian.org/1090395
[160] https://tracker.debian.org/pkg/binutils
* Johannes Schauer Marin Rodrigues:
* #1089092 [161] filed against hurd [162].
[161] https://bugs.debian.org/1089092
[162] https://tracker.debian.org/pkg/hurd
* Moritz Schlarb:
* #1090078 [163] filed against firehol [164].
[163] https://bugs.debian.org/1090078
[164] https://tracker.debian.org/pkg/firehol
* Roland Clobus:
* #1090981 [165] filed against dictionaries-common [166].
[165] https://bugs.debian.org/1090981
[166] https://tracker.debian.org/pkg/dictionaries-common
§
Reproducibility testing framework
---------------------------------
The Reproducible Builds project operates a comprehensive testing
framework running primarily at tests.reproducible-builds.org [167] in
order to check packages and other artifacts for reproducibility. In
November, a number of changes were made by Holger Levsen, including:
[167] https://tests.reproducible-builds.org
* reproduce.debian.net [168]-related:
* Add a new i386.reproduce.debian.net
rebuilder. [169][170][171][172][173][174]
* Make a number of updates to the
documentation. [175][176][177][178][179]
* Run i386.reproduce.debian.net run on a public port to allow
external workers. [180]
* Add a link to the /api/v0/pkgs/list endpoint. [181]
* Add support for a statistics [182]
page. [183][184][185][186][187][188]
* Limit build logs to 20 MiB and *diffoscope* output to 10
MiB. [189]
* Improve the frontpage [190]. [191][192]
* Explain that we're testing arch:any and arch:all on the amd64
architecture, but only arch:any on i386. [193]
[168] https://reproduce.debian.net
[169] https://salsa.debian.org/qa/jenkins.debian.net/commit/c93a67baf
[170] https://salsa.debian.org/qa/jenkins.debian.net/commit/f3a95c16d
[171] https://salsa.debian.org/qa/jenkins.debian.net/commit/f86d327c5
[172] https://salsa.debian.org/qa/jenkins.debian.net/commit/4dd9e2436
[173] https://salsa.debian.org/qa/jenkins.debian.net/commit/6b931c382
[174] https://salsa.debian.org/qa/jenkins.debian.net/commit/980d9cd27
[175] https://salsa.debian.org/qa/jenkins.debian.net/commit/e9599f791
[176] https://salsa.debian.org/qa/jenkins.debian.net/commit/ab79a01e4
[177] https://salsa.debian.org/qa/jenkins.debian.net/commit/da2401fa7
[178] https://salsa.debian.org/qa/jenkins.debian.net/commit/a85e23463
[179] https://salsa.debian.org/qa/jenkins.debian.net/commit/7384ce3af
[180] https://salsa.debian.org/qa/jenkins.debian.net/commit/44c310c48
[181] https://salsa.debian.org/qa/jenkins.debian.net/commit/2f9a12a3f
[182] https://amd64.reproduce.debian.net/stats/
[183] https://salsa.debian.org/qa/jenkins.debian.net/commit/51944feb3
[184] https://salsa.debian.org/qa/jenkins.debian.net/commit/ad640d318
[185] https://salsa.debian.org/qa/jenkins.debian.net/commit/0f575d45f
[186] https://salsa.debian.org/qa/jenkins.debian.net/commit/364a247b3
[187] https://salsa.debian.org/qa/jenkins.debian.net/commit/cb0948b13
[188] https://salsa.debian.org/qa/jenkins.debian.net/commit/360f38e59
[189] https://salsa.debian.org/qa/jenkins.debian.net/commit/90fe5f690
[190] https://amd64.reproduce.debian.net/
[191] https://salsa.debian.org/qa/jenkins.debian.net/commit/96050e1d6
[192] https://salsa.debian.org/qa/jenkins.debian.net/commit/06b546d65
[193] https://salsa.debian.org/qa/jenkins.debian.net/commit/e87f6d3ab
* Misc:
* Remove code for testing Arch Linux, which has moved to
reproduce.archlinux.org [194]. [195][196]
* Don't install dstat [197] on Jenkins nodes anymore as its been
removed from Debian 'trixie'. [198]
* Prepare the infom08-i386 node to become another rebuilder. [199]
* Add debug date output for benchmarking the
reproducible_pool_buildinfos.sh script. [200]
* Install installation-birthday [201] everywhere. [202]
* Temporarily disable automatic updates of pool links on
buildinfos.debian.net [203]. [204]
* Install Recommends by default on Jenkins nodes. [205]
* Rename rebuilder_stats.py to rebuilderd_stats.py. [206]
* r.d.n/stats: minor formatting changes. [207]
* Install files under /etc/cron.d/ with the correct
permissions. [208]
[194] https://reproducible.archlinux.org
[195] https://salsa.debian.org/qa/jenkins.debian.net/commit/f74d5cc65
[196] https://salsa.debian.org/qa/jenkins.debian.net/commit/6e0853fc2
[197] https://tracker.debian.org/pkg/dstat
[198] https://salsa.debian.org/qa/jenkins.debian.net/commit/a60fff3e9
[199] https://salsa.debian.org/qa/jenkins.debian.net/commit/7326d0824
[200] https://salsa.debian.org/qa/jenkins.debian.net/commit/a3c525594
[201] https://tracker.debian.org/pkg/installation-birthday
[202] https://salsa.debian.org/qa/jenkins.debian.net/commit/af8cf9022
[203] https://buildinfos.debian.net/
[204] https://salsa.debian.org/qa/jenkins.debian.net/commit/65f6c496b
[205] https://salsa.debian.org/qa/jenkins.debian.net/commit/5137ed27f
[206] https://salsa.debian.org/qa/jenkins.debian.net/commit/d4346cc75
[207] https://salsa.debian.org/qa/jenkins.debian.net/commit/68362c7c3
[208] https://salsa.debian.org/qa/jenkins.debian.net/commit/15e85eb0e
… and Jochen Sprickerhof made the following changes:
* Always prefer official .buildinfo on buildinfos.debian.net [209]
files. [210][211][212]
* Add a rebuilder_stats.py scripts. [213]
[209] https://buildinfos.debian.net/
[210] https://salsa.debian.org/qa/jenkins.debian.net/commit/c5bd2cdd5
[211] https://salsa.debian.org/qa/jenkins.debian.net/commit/f3996505a
[212] https://salsa.debian.org/qa/jenkins.debian.net/commit/e3fa9e786
[213] https://salsa.debian.org/qa/jenkins.debian.net/commit/a4bf4abbf
Lastly, Gioele Barabucci also classified packages affected by 1-second
offset issue filed as Debian bug #1089088 [214][215][216][217][218],
Chris Hofstaedtler updated the URL for Grml [219]'s dpkg.selections
[220] file [221], Roland Clobus updated the Jenkins log parser [222] to
parse warnings from diffoscope [224] and Mattia Rizzolo banned a
number of bots and crawlers from the service [225][226].
[214] https://bugs.debian.org/1089088
[215] https://salsa.debian.org/qa/jenkins.debian.net/commit/560abcc06
[216] https://salsa.debian.org/qa/jenkins.debian.net/commit/7ecb50252
[217] https://salsa.debian.org/qa/jenkins.debian.net/commit/4ec0ce172
[218] https://salsa.debian.org/qa/jenkins.debian.net/commit/deac53d9e
[219] https://grml.org
[220] https://grml.org/files/grml-full-latest-amd64/dpkg.selections
[221] https://salsa.debian.org/qa/jenkins.debian.net/commit/18f5518ea
[222] https://plugins.jenkins.io/log-parser/
[224] https://salsa.debian.org/qa/jenkins.debian.net/commit/e6d4a3a14
[225] https://salsa.debian.org/qa/jenkins.debian.net/commit/eac87a506
[226] https://salsa.debian.org/qa/jenkins.debian.net/commit/4a2733e4f
§
If you are interested in contributing to the Reproducible Builds
project, please visit our "Contribute" [227] page on our website.
However, you can get in touch with us via:
* IRC: #reproducible-builds on irc.oftc.net.
* Mastodon: @reproducible_builds at fosstodon.org [228]
* Mailing list: rb-general at lists.reproducible-builds.org [229]
* Twitter: @ReproBuilds [230]
[227] https://reproducible-builds.org/contribute/
[228] https://fosstodon.org/@reproducible_builds
[229] https://lists.reproducible-builds.org/listinfo/rb-general
[230] https://twitter.com/ReproBuilds
--
o
⬋ ⬊
o o reproducible-builds.org 💠
⬊ ⬋
o
More information about the rb-general
mailing list