--- layout: blog week: 53 published: 2016-05-02 19:05:00 --- What happened in the [Reproducible Builds](https://wiki.debian.org/ReproducibleBuilds) effort between April 24th and 30th 2016. Media coverage -------------- Reproducible builds were mentioned explicitly in two talks at the [Mini-DebConf in Vienna](http://debienna.at/minidebconf_vie2016/): * Martin Michlmayr had a talk in which he presented an overview about [innovations and changes in Debian in the last years](http://meetings-archive.debian.net/pub/debian-meetings/2016/mini-debconf-vienna/webm/Innovations_in_the_Debian_project.webm). Martin expressed his disappointment that there was no talk from us in Vienna (we'll fix this at DebConf16 in Cape Town) and described the reproducible builds work as "a real innovation". His talk is very much worth seeing, whatever your current perspective, it might change your view on Debian. * Ben Hutchings explains how [Secure Boot](http://meetings-archive.debian.net/pub/debian-meetings/2016/mini-debconf-vienna/webm/Secure_Boot_vs_the_Debian_linux_package.webm) will use signed kernels via separate signature packages and how this was designed with reproducible builds in mind. Aspiration together with the OTF CommunityLab released [their report](https://reproducible-builds.org/files/AspirationOTFCommunityLabReproducibleBuildsSummitReport.pdf) about the [Reproducible Builds summit in December 2015 in Athens](https://reproducible-builds.org/events/athens2015/). Toolchain fixes --------------- Now that the GCC development window has been opened again, the *SOURCE_DATE_EPOCH* patch by Dhole and Matthias Klose to address the issue [timestamps_from_cpp_macros](https://tests.reproducible-builds.org/issues/unstable/timestamps_from_cpp_macros_issue.html) (`__DATE__` / `__TIME__`) has been [applied upstream](https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=e3e8c48c4a494d9da741c1c8ea6c4c0b7c4ff934) and will be released with GCC 7. Following that Matthias Klose also has uploaded [gcc-5](https://tracker.debian.org/pkg/gcc-5)/5.3.1-17 and [gcc-6](https://tracker.debian.org/pkg/gcc-6)/6.1.1-1 to unstable with a backport of that *SOURCE_DATE_EPOCH* patch. Emmanuel Bourg uploaded [maven](https://tracker.debian.org/pkg/maven)/3.3.9-4, which uses *SOURCE_DATE_EPOCH* for the `maven.build.timestamp`. ([SOURCE_DATE_EPOCH specification](https://reproducible-builds.org/specs/source-date-epoch/)) Other upstream changes ---------------------- Alexis Bienvenüe [submitted a patch](https://github.com/sphinx-doc/sphinx/pull/2503) to Sphinx which extends *SOURCE_DATE_EPOCH* support for copyright years in generated documentation. Packages fixed -------------- The following 12 packages have become reproducible due to changes in their build dependencies: [hhvm](https://tracker.debian.org/pkg/hhvm) [jcsp](https://tracker.debian.org/pkg/jcsp) [libfann](https://tracker.debian.org/pkg/libfann) [libflexdock-java](https://tracker.debian.org/pkg/libflexdock-java) [libjcommon-java](https://tracker.debian.org/pkg/libjcommon-java) [libswingx1-java](https://tracker.debian.org/pkg/libswingx1-java) [mobile-atlas-creator](https://tracker.debian.org/pkg/mobile-atlas-creator) [not-yet-commons-ssl](https://tracker.debian.org/pkg/not-yet-commons-ssl) [plexus-utils](https://tracker.debian.org/pkg/plexus-utils) [squareness](https://tracker.debian.org/pkg/squareness) [svnclientadapter](https://tracker.debian.org/pkg/svnclientadapter) The following packages have became reproducible after being fixed: * [anope](https://tracker.debian.org/pkg/anope)/2.0.3-2 by Dominic Hargreaves, [#820152](https://bugs.debian.org/820152) by Alexis Bienvenüe. * [apparmor-profiles-extra](https://tracker.debian.org/apparmor-profiles-extra)/1.7 by intrigeri, [patch](https://anonscm.debian.org/cgit/collab-maint/apparmor-profiles-extra.git/commit/?id=fef58bbf9c34a173b5ad97445d53c11dbe4fec04) by Felix Geyer. * [basket](https://tracker.debian.org/basket)/2.10~beta+git20160425.b77687f-1 by Luigi Toscano, [original patch](https://bugs.debian.org/819921) by Alexis Bienvenüe. * [bind-dyndb-ldap](https://tracker.debian.org/bind-dyndb-ldap)/8.0-2 by Timo Aaltonen. * [bliss](https://tracker.debian.org/bliss)/0.73-1 by Jerome Benoit. * [gap-alnuth](https://tracker.debian.org/gap-alnuth)/3.0.0-3 by Bill Allombert. * [gap-radiroot](https://tracker.debian.org/gap-radiroot)/2.7-2 by Bill Allombert. * [genometools](https://tracker.debian.org/genometools)/1.5.8+ds-3 by Sascha Steinbiss. * [gprbuild](https://tracker.debian.org/gprbuild)/2015-3 by Nicolas Boulenguez. * [gtkhash](https://tracker.debian.org/gtkhash)/0.7.0-3 by Mònica Ramírez Arceda. * [josm](https://tracker.debian.org/josm)/0.0.svn10161+dfsg-1 by Bas Couwenberg. * [libjgoodies-animation-java](https://tracker.debian.org/libjgoodies-animation-java)/1.4.3-1 by Markus Koschany. * [ltrsift](https://tracker.debian.org/ltrsift)/1.0.2-7 by Sascha Steinbiss. * [mutt](https://tracker.debian.org/mutt)/1.6.0-1 by Matteo F. Vescovi, [original patch](https://bugs.debian.org/818419) by Daniel Shahaf. * [netsniff-ng](https://tracker.debian.org/netsniff-ng)/0.6.1-1 by Kartik Mistry, [original patch](https://bugs.debian.org/806547) by Reiner Herrmann. * [netrw](https://tracker.debian.org/netrw)/1.3.2-3 by Giovanni Mascellani. * [openthesaurus](https://tracker.debian.org/openthesaurus)/20160424-3 by Rene Engelhard, [original patch](https://bugs.debian.org/792599) by Dhole. * [php-pear](https://tracker.debian.org/php-pear)/1:1.10.1+submodules+notgz-8 by Mathieu Parent. * [samba](https://tracker.debian.org/samba)/2:4.4.2+dfsg-2 by Jelmer Vernooij. * [swift](https://tracker.debian.org/swift)/2.7.0-3 by Ondřej Nový. * [tp-smapi](https://tracker.debian.org/tp-smapi)/0.42-1 by Evgeni Golov, [original patch](https://bugs.debian.org/778217) by Chris Lamb. * [vifm](https://tracker.debian.org/vifm)/0.8.1a-0.1 by Ondřej Nový. * [xfonts-mplus](https://tracker.debian.org/xfonts-mplus)/1:2.2.4-2 by Hideki Yamane, [original patch](https://bugs.debian.org/778225) by Chris Lamb. * [xpa](https://tracker.debian.org/xpa)/2.1.17-2 by Ole Streicher, [original patch](https://bugs.debian.org/822561) by Alexis Bienvenüe. Some uploads have fixed some reproducibility issues, but not all of them: * [camitk](https://tracker.debian.org/camitk)/4.0.0~beta-1 by Emmanuel Promayon, [original patch](https://bugs.debian.org/794740) by Maria Valentina Marin. * [elastix](https://tracker.debian.org/elastix)/4.8-8 by Gert Wollny. * [freefem++](https://tracker.debian.org/freefem++)/3.46+dfsg1-1 by Dimitrios Eftaxiopoulos, [original patch](https://bugs.debian.org/820815) by Alexis Bienvenüe. * [grib-api](https://tracker.debian.org/grib-api)/1.15.0-1 by Alastair McKinstry, [original patch](https://bugs.debian.org/820990) by Santiago Vila. * [isorelax](https://tracker.debian.org/isorelax)/20041111-9 by Emmanuel Bourg. * [libical](https://tracker.debian.org/libical)/2.0.0-0.1 by Andreas Henriksson, [original patch](https://bugs.debian.org/796360) by Chris Lamb. * [sawfish](https://tracker.debian.org/sawfish)/1:1.11.90-1 by Jose M Calhariz, [original patch](https://bugs.debian.org/820668) by Alexis Bienvenüe. * [singular](https://tracker.debian.org/singular)/4.0.3-p1+ds-1 by Jerome Benoit. * [syslinux](https://tracker.debian.org/syslinux)/3:6.03+dfsg-12 by Mattia Rizzolo, [original patch](https://anonscm.debian.org/git/collab-maint/syslinux.git/commit/?id=a1cf4d3ab9edd2f58bdec63ffb3d07e17db9dad5) by Reiner Herrmann. * [transdecoder](https://tracker.debian.org/transdecoder)/2.0.1+dfsg-3 by Michael R. Crusoe, [original patch](https://bugs.debian.org/822268) by Dhole. Patches submitted that have not made their way to the archive yet: * [#822566](https://bugs.debian.org/822566) against [stk](https://tracker.debian.org/stk) by Alexis Bienvenüe: sort lists of object files for reproducible linking order. * [#822948](https://bugs.debian.org/822948) against [shotwell](https://tracker.debian.org/shotwell) by Alexis Bienvenüe: normalize tarball permissions and use locale/timezone-independent modification time. * [#822963](https://bugs.debian.org/822963) against [htop](https://tracker.debian.org/htop) by Alexis Bienvenüe: use *SOURCE_DATE_EPOCH* for embedded copyright year, which has before already been applied [in git](https://anonscm.debian.org/cgit/collab-maint/htop.git/commit/?id=cef9e7933e5c9704eaa5a6330067967f32e52798) and [upstream](https://github.com/hishamhm/htop/pull/476). Package reviews --------------- 95 reviews have been added, 15 have been updated and 129 have been removed in this week. 22 FTBFS bugs have been reported by Chris Lamb and Martin Michlmayr. diffoscope development ---------------------- * diffoscope 52~bpo8+1 has been uploaded to jessie-backports by Mattia Rizzolo, where it is currently waiting for NEW-approval. * Support for the [deb(5) format](https://wiki.debian.org/Teams/Dpkg/DebSupport) (uncompressed data.tar/control.tar, control.tar.xz) (Closes: [#818414](https://bugs.debian.org/818414)) has been completed by Reiner Herrmann in git. strip-nondeterminism development -------------------------------- * Support for EPUB documents has been added (to the development version in git) by Holger Levsen, to address the [timestamps_in_epub issue](https://tests.reproducible-builds.org/issues/unstable/timestamps_in_epub_issue.html). tests.reproducible-builds.org ----------------------- * To [monitor the uptodateness of diffoscope everywhere](https://jenkins.debian.net/view/reproducible/view/diffoscope/), tests checking this on FreeBSD, NetBSD & MacPorts were added. Tests on other distributions will be added once the relevant bugs in [whohas](https://tracker.debian.org/whohas) are fixed in jessie. (h01ger) Misc. ----- Amongst the [29 interns who will work on Debian through GSoC and Outreachy](https://bits.debian.org/2016/04/welcome-summer-interns-2016.html) there are four who will be contributing to Reproducible Builds for Debian and Free Software. We are very glad to welcome ceridwen, Satyam Zode, Scarlett Clark and Valerie Young and look forward to working together with them the coming months (and maybe beyond)! This week's edition was written by Reiner Herrmann and Holger Levsen and reviewed by a bunch of Reproducible builds folks on IRC.