--- layout: blog week: 163 published: 2018-06-11 21:45:19 --- Here's what happened in the [Reproducible Builds](https://reproducible-builds.org) effort between Sunday June 3 and Saturday June 9 2018: * [Sylvain Beucler](https://blog.beuc.net/) published a blog post about his [latest progress in making reproducible Windows builds](https://blog.beuc.net/posts/Reproducible_Windows_builds/) using the [MXE](http://mxe.cc/) cross-build environment, [`SOURCE_DATE_EPOCH`](https://reproducible-builds.org/specs/source-date-epoch/), etc. * A new version of the [u-boot Universal Boot Loader](https://www.denx.de/wiki/U-Boot) was released, merging a changeset from Vagrant Cascadian [fixing time and umask embedded into generated images](http://git.denx.de/?p=u-boot.git;a=commit;h=8664ab7debabfb6e1049c81030c2a18fd3eecb58). * Within Debian, Holger Levsen enquired about the status of Debian bug [#802241](https://bugs.debian.org/802241) ("`dpkg`: please store the hash of the installed `.deb` and allow one to query it") which resulted in bug [#774415](https://bugs.debian.org/774415) ("Please add the `srebuild` wrapper for reproducible builds") being reassigned to the [`devscripts`](https://salsa.debian.org/debian/devscripts) package. * Mattia Rizollo updated our patched [gcc-7 package]((https://tracker.debian.org/pkg/gcc-7)) and uploaded it to our [experimental Debian toolchain repository](https://wiki.debian.org/ReproducibleBuilds/ExperimentalToolchain) * The next next reproducible builds IRC meeting has been scheduled for [Tuesday the 19th at 16:00 UTC](http://time.is/compare/1600_19_Jun_2018_in_UTC) and [an agenda is being collected](https://pad.riseup.net/p/reproducible-irc-meeting-12). Development work ---------------- * Chris Lamb [submitted a merge request to the Debian Installer](https://salsa.debian.org/installer-team/debian-installer/merge_requests/3) to make the installation images (ISO, hd-media, netboot, etc,) bit-for-bit reproducible. It currently requires a rebuild of the [GNU mtools](https://www.gnu.org/software/mtools/) that has patches from Debian bugs [#900409](https://bugs.debian.org/900409) & [#900410](https://bugs.debian.org/900410) applied. A tracking bug for this feature was filed in the BTS as [#900918](https://bugs.debian.org/900918). * Bernhard M. Wiedemann: * [gcc](https://gcc.gnu.org/ml/gcc-patches/2018-06/msg00516.html) -- sort input file list * [python-fastnumbers](https://github.com/SethMMorton/fastnumbers/pull/12) -- sort input file list * [openSUSE/acl](https://bugzilla.opensuse.org/show_bug.cgi?id=1095795) -- date in [gettext](https://www.gnu.org/software/gettext/) * In [diffoscope](https://diffoscope.org/), Chris Lamb [rewrote a call to `readdir\_r(3)` to use `readdir(3)` instead](https://salsa.debian.org/reproducible-builds/disorderfs/commit/fbfd4d0) as the former has been deprecated in glibc 2.24. This silences a `-Wdeprecated-declarations` GCC warning. Upcoming events =============== * On Wednesday 13th June, Chris Lamb will present at [foss-backstage.de](https://foss-backstage.de) in Berlin, Germany [on reproducible builds and how they prevent developers being targets for malicious attacks](https://foss-backstage.de/session/think-youre-not-target-tale-3-developers). * [Kirill Nikitin](https://people.epfl.ch/kirill.nikitin)'s talk entitled "[Securing Debian Software Updates with Skipchains and Verified Builds](https://debconf18.debconf.org/talks/46-securing-debian-software-updates-with-skipchains-and-verified-builds/)" was accepted by the [DebConf18](https://debconf18.debconf.org) programme committee. * Our talk on "[Reproducible Buster and beyond](https://debconf18.debconf.org/talks/80-reproducible-buster-and-beyond/)" was also accepted for DebConf18. tests.reproducible-builds.org development ----------------------------------------- There were a number of changes to our [Jenkins](https://jenkins.io/)-based testing framework that powers [tests.reproducible-builds.org](https://tests.reproducible-builds.org/), including: * Holger Levsen: * [Use our own SSL cert for tests.reproducible-builds.org](https://salsa.debian.org/qa/jenkins.debian.net/commit/98759b20). * Update a number of URLs to match the [migration to salsa.debian.org](https://wiki.debian.org/Salsa/AliothMigration). ([1](https://salsa.debian.org/qa/jenkins.debian.net/commit/f9777bdd), [2](https://salsa.debian.org/qa/jenkins.debian.net/commit/93970226), [3](https://salsa.debian.org/qa/jenkins.debian.net/commit/b6b60b84). [4](https://salsa.debian.org/qa/jenkins.debian.net/commit/f613997e). [5](https://salsa.debian.org/qa/jenkins.debian.net/commit/533f17f2)) * [Handle a false-positive diskspace issue when building clisp](https://salsa.debian.org/qa/jenkins.debian.net/commit/e23f278d). * Jelle van der Waa: * [Remove installation of `pacman-git`](https://salsa.debian.org/qa/jenkins.debian.net/commit/c414ae7f) in [Arch Linux](https://www.archlinux.org/) reproducibility testing. In addition, Mattia Rizzolo has been working in a large refactor of the Python part of the setup. Documentation updates --------------------- * Mattia Rizzolo updated various `README` files in [our tools](https://reproducible-builds.org/tools/) on how to release the tarballs after moving to new infrastructure. ([1](https://salsa.debian.org/reproducible-builds/strip-nondeterminism/commit/9f1c756), [2](https://salsa.debian.org/reproducible-builds/disorderfs/commit/4810a11), [3](https://salsa.debian.org/reproducible-builds/reprotest/commit/1140670)), [4](https://salsa.debian.org/reproducible-builds/trydiffoscope/commit/63ae0f7)) * Chris Lamb also updated our [reproducible-builds.org](https://reproducible-builds.org/) website to [add Steven Chamberlain's "Fun with .buildinfo"](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/e8ed178) and [update the entry our DebConf17 status update](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/c59f287) to the [Talks & Resources](https://reproducible-builds.org/resources/) page. * Anxhelo Lushka from Ura Design [provided us with a new visual layout and style guide](https://lists.reproducible-builds.org/pipermail/rb-general/2018-June/001001.html) for our website. This will hopefully be integrated in the next week or so. * This week, 40 package reviews were been added, 16 have been updated and 37 have been removed, adding to our [knowledge about identified issues](https://tests.reproducible-builds.org/debian/index_issues.html). Misc. ----- This week's edition was written by Bernhard M. Wiedemann, Chris Lamb, Holger Levsen, Mattia Rizzolo, Santiago Torres, Vagrant Cascadian & reviewed by a bunch of Reproducible Builds folks on IRC & the mailing lists.