The first “reproducible world summit” was held in Athens, Greece, from December 1st-3rd with the support of the Linux Foundation, the Open Tech Fund, and Google. Faidon Liambotis has been an amazing help to sort out all local details. People at ImpactHub Athens have been perfect hosts.

North of Athens from the Acropolis with ImpactHub in the center

Nearly 40 participants from 14 different free software project had very busy days sharing knowledge, building understanding, and producing actual patches.

Anyone interested in cross project discussions should join the rb-general mailing-list.

What follows focuses mostly on what happened for Debian this previous week. A more detailed report about the summit will follow soon. You can also read the ones from Joachim Breitner from Debian, Clemens Lang from MacPorts, Georg Koppen from Tor, Dhiru Kholia from Fedora, and Ludovic Courtès wrote one for Guix and for the GNU project.

The Acropolis from Μοναστηράκι

Infrastructure

Several discussions at the meeting helped refine a shared understanding of what kind of information should be recorded on a build, and how they could be used. Daniel Kahn Gillmor sent a detailed update on how .buildinfo files should become part of the Debian archive.

Some key changes compared to what we had in mind at DebConf15:

  • Two .buildinfo with different environment information can attest to the same exact binary artifact.
  • Multiple .buildinfo files can coexist for the same .deb as long as the listed checksums match the source and binary package in the archive.
  • .buildinfo can be signed in-line to certify where a build comes from.

Hopefully, ftpmasters will be able to comment on the updated proposal soon.

Packages fixed

The following packages have become reproducible due to changes in their build dependencies: fades, triplane, caml-crush, globus-authz.

The following packages became reproducible after getting fixed:

Some uploads fixed some reproducibility issues, but not all of them:

Patches submitted which have not made their way to the archive yet:

  • #806580 on metview by Reiner Herrmann: remove timestamps from metview script.
  • #806974 on xpra by Reiner Herrmann: interpret the changelog date as UTC.
  • #807051 on why by Valentin Lorentz: removes extra timestamps from the build system.

akira sent proposals on how to make bash reproducible.

Alexander Couzens submitted a patch upstream to add support for SOURCE_DATE_EPOCH in grub image generator (#787795).

reproducible.debian.net

An issue with some armhf build nodes was tracked down to a bad interaction between uname26 personality and new glibc (Vagrant Cascadian).

A Debian package was created for koji, the RPM building and tracking system used by Fedora amongst others. It is currently waiting for review in the NEW queue. (Ximin Luo, Marek Marczykowski-Górecki)

diffoscope development

diffoscope now has a dedicated mailing list to better accommodate its growing user and developer base.

Going through diffoscope's guts together enabled several new contributors. Baptiste Daroussin, Ed Maste, Clemens Lang, Mike McQuaid, Joachim Breitner all contributed their first patches to improve portability or add new features. Regular contributors Chris Lamb, Reiner Herrmann, and Levente Polyak also submitted improvements.

diffoscope hacking session in Athens

The next release should support more operating systems, filesystem image comparison via libguestfs, HTML reports with on-demand loading, and parallel processing for the most noticeable improvements.

Package reviews

27 reviews have been removed, 17 added and 14 updated in the previous week.

Chris Lamb and Val Lorentz filed 4 new FTBFS reports.

Misc.

Baptiste Daroussin has started to implement support for SOURCE_DATE_EPOCH in FreeBSD in libpkg and the ports tree.

Thanks Joachim Breitner and h01ger for the pictures.