--- layout: blog week: 131 published: 2017-11-03 17:11:12 --- Here's what happened in the [Reproducible Builds](https://reproducible-builds.org) effort between Sunday October 22 and Saturday October 28 2017: Past Events ----------- - On Tuesday 24th October, Chris Lamb presented at [All Things Open 2017](https://allthingsopen.org) in Raleigh, NC, USA. - On Wednesday 25th October, [Holger Levsen presented](https://osseu17.sched.com/event/BxJs/reproducible-builds-we-made-lots-of-progress-in-many-places-but-were-still-far-from-our-goals-of-changing-the-software-world-holger-levsen) at the [Open Source Summit Europe](https://osseu17.sched.com) in Prague, Czech Republic. - On Saturday 28th October, Chris Lamb presented at [freenode.live](https://freenode.live) in Bristol, UK. Upcoming/current events ----------------------- - From October 31st — November 2nd we will be holding the [3rd Reproducible Builds summit](https://reproducible-builds.org/events/berlin2017/) in Berlin, Germany. - On November 8th Jonathan Bustillos Osornio (jathan) will present at [CubaConf Havana](http://www.cubaconf.org/). Documentation updates --------------------- Bernhard Wiedemann started [The Unreproducible Package](https://github.com/bmwiedemann/theunreproduciblepackage) which "is meant as a practical way to demonstrate the various ways that software can break reproducible builds using just low level primitives without requiring external existing programs that implement these primitives themselves. It is structured so that one subdirectory demonstrates one class of issues in some variants observed in the wild." Reproducible work in other projects ----------------------------------- Hush, a fork of ZCash, [opened an issue](https://github.com/MyHush/hush/issues/60) into reproducible builds. A [new tag](https://lintian.debian.org/tags/latest-changelog-entry-without-new-date.html) was added to lintian (lint checker for Debian packages) to ensure that changelog entry timestamps are strictly increasing. This avoids certain real-world issues with identical timestamps, documented in Debian [#843773](https://bugs.debian.org/843773). Packages reviewed and fixed, and bugs filed ------------------------------------------- Patches sent upstream: * Bernhard M. Wiedemann: * [gtranslator](https://bugzilla.gnome.org/show_bug.cgi?id=789380), embedded build timestamps * [libgda](https://bugzilla.gnome.org/show_bug.cgi?id=789382), embedded build timestamps * [mariadb](https://github.com/MariaDB/server/pull/472), embedded build timestamps * [nim](https://github.com/nim-lang/Nim/pull/6581), embedded build timestamps Debian bug reports: * Chris Lamb: * [#879569](https://bugs.debian.org/879569) filed against [argagg](https://tracker.debian.org/pkg/argagg). * [#879913](https://bugs.debian.org/879913) filed against [sdlgfx](https://tracker.debian.org/pkg/sdlgfx). * [#879914](https://bugs.debian.org/879914) filed against [fmtlib](https://tracker.debian.org/pkg/fmtlib). Reviews of unreproducible packages ---------------------------------- 14 package reviews have been added, 35 have been updated and 28 have been removed in this week, adding to our knowledge about [identified issues](https://tests.reproducible-builds.org/debian/index_issues.html). 1 issue type has been updated: - Add [nondeterministic_ordering_in_documentation_generated_by_doxygen](https://tests.reproducible-builds.org/issues/unstable/nondeterministic_ordering_in_documentation_generated_by_doxygen_issue.html). Weekly QA work -------------- During our reproducibility testing, FTBFS bugs have been detected and reported by: - Adrian Bunk (4) strip-nondeterminism development -------------------------------- Version [0.040-1](https://tracker.debian.org/news/882433) was uploaded to unstable by Mattia Rizzolo. It included [contributions](https://salsa.debian.org/reproducible-builds/strip-nondeterminism/commits/debian/0.040-1) already covered by posts of the previous weeks, as well as new ones from: - Mattia Rizzolo: - png.pm: Don't open the original file in write mode reprotest development --------------------- Development continued in [git](https://salsa.debian.org/reproducible-builds/reprotest.git/log/): - Ximin Luo: - New features: - Support a `domain_host` variation. - Support a `--print-sudoers` feature. - Documentation: - Note some caveats about the existing git versions as a self-reminder not to release it yet. - Updates about our assumptions and rearrange sudo into its own section. - Bug fixes: - main: When dropping privs, make sure the user can still move in theroot. - tests: fix, need to preserve env for su - build: Don't fail when the build produces a broken symlink - main, presets: Properly drop privs when running the build. (Closes: [#877813](https://bugs.debian.org/877813)) - Code quality: - Improve logging to try to get to the bottom of the jenkins failures - Tweak tests to avoid some build dependencies - build: Name temporary directories after reprotest not autopkgtest buildinfo.debian.net development -------------------------------- Development continued in [git](https://salsa.debian.org/reproducible-builds/buildinfo.debian.net.git/log/): - Chris Lamb: - New features: - Add API endpoint to fetch specific .buildinfo files for a certain package/version/architecture, and optimise it. (Closes: #25) - Bug fixes: - Always show SHA256, regardless of viewport size. (Closes: #27) - Actually filter by source package (!) reproducible-website development -------------------------------- - Holger Levsen: - RWS3 Berlin 2017: - Add CoyIM, Arch Linux, LEDE, LEAP, subuser.org, Bazel, coreboot. - Make some sponsors visible. - Add short paragraph explaining that registration is mandatory. Misc. ----- This week's edition was written by Ximin Luo, Chris Lamb, Bernhard M. Wiedemann and Holger Levsen & reviewed by a bunch of Reproducible Builds folks on IRC & the mailing lists.