What happened about the reproducible builds effort for this week:

Toolchain fixes

Uploads that should help other packages:

  • Stephen Kitt uploaded mingw-w64/4.0.2-2 which avoids inserting timestamps in PE binaries, and specify dlltool's temp prefix so it generates reproducible files.
  • Stephen Kitt uploaded binutils-mingw-w64/6.1 which fixed dlltool to initialize its output's .idata$6 section, avoiding random data ending up there.

Patch submitted for toolchain issues:

  • #787159 on openjdk-7 by Emmanuel Bourg: sort the annotations and enums in package-tree.html produced by javadoc.
  • #787250 on python-qt4 by Reiner Herrmann: sort imported modules to get reproducible output.
  • #787251 on pyqt5 by Reiner Herrmann: sort imported modules to get reproducible output.

Some discussions have been started in Debian and with upstream:

Packages fixed

The following 8 packages became reproducible due to changes in their build dependencies: access-modifier-checker, apache-log4j2, jenkins-xstream, libsdl-perl, maven-shared-incremental, ruby-pygments.rb, ruby-wikicloth, uimaj.

The following packages became reproducible after getting fixed:

Some uploads fixed some reproducibility issues but not all of them:

Patches submitted which did not make their way to the archive yet:

  • #777308 on dhcp-helper by Dhole: fix mtimes of packaged files.
  • #786927 on flowscan by Dhole: remove timestamps from gzip files and fix mtimes of packaged files.
  • #786959 on python3.5 by Lunar: set build date of binary and documentation to the time of latest debian/changelog entry, prevent gzip from storing a timestamp.
  • #786965 on python3.4 by Lunar: same as python3.5.
  • #786978 on python2.7 by Lunar: same as python3.5.
  • #787122 on xtrlock by Dhole: fix mtimes of packaged files.
  • #787123 on rsync by Dhole: remove timestamps from gzip files and fix mtimes of packaged files.
  • #787125 on pachi by Dhole: fix mtimes of packaged files.
  • #787126 on nis by Dhole: remove timestamps from gzip files and fix mtimes of packaged files.
  • #787206 on librpc-xml-perl by Reiner Herrmann: remove timestamps from generated code.
  • #787265 on libwx-perl by Reiner Herrmann: produce sorted output.
  • #787303 on dos2unix by Juan Picca: set manpage date to the time of latest entry in debian/changelog.
  • #787327 on vim by Reiner Herrmann: remove usage of __DATE__ and __TIME__ macros.

Discussions that have been started:

reproducible.debian.net

Holger Levsen added two new package sets: pkg-javascript-devel and pkg-php-pear. The list of packages with and without notes are now sorted by age of the latest build.

Mattia Rizzolo added support for email notifications so that maintainers can be warned when a package becomes unreproducible. Please ask Mattia or Holger or in the #debian-reproducible IRC channel if you want to be notified for your packages!

strip-nondeterminism development

Andrew Ayer fixed the gzip handler so that it skip adding a predetermined timestamp when there was none.

Documentation update

Lunar added documentation about mtimes of file extracted using unzip being timezone dependent. He also wrote a short example on how to test reproducibility.

Stephen Kitt updated the documentation about timestamps in PE binaries.

Documentation and scripts to perform weekly reports were published by Lunar.

Package reviews

50 obsolete reviews have been removed, 51 added and 29 updated this week. Thanks Chris West and Mathieu Bridon amongst others.

New identified issues:

Misc.

Lunar will be talking (in French) about reproducible builds at Pas Sage en Seine on June 19th, at 15:00 in Paris.

[Meeting](meeting will happen this Wednesday, 19:00 UTC.