partial snapshot mirror amd64/bullseye/bookworm

[Vagrant Cascadian]

On 2021-02-27, Holger Levsen wrote:
> snapshot.debian.org is an awesome service for the wider free software community
> and especially for those working on reproducible builds. Sadly accessing *many*
> packages from it is limited and troublesome (see below for bug numbers), thus
> we (mostly Frédéric Pierret and myself) came up with the idea of setting up a
> partial mirror, covering only the years 2017 until now and arch:amd64 and arch:all
> only as well. (for a start, maybe we need 2015+2016 too and maybe we can afford
> to also host arm64 or some other architecture...)
...
> #977653 Please document rate limits on snapshots.debian.org
> #960304 snapshot.debian.org: Snapshot repo repeatedly cutting off connection, returning partial content
> #969906 snapshot.debian.org: error 500 internal server error after some requests via Python

I'd like to point out that these issues are basically the last known
major blockers to performing verification builds against packages
actually in the Debian archive (as opposed to the builds done on
tests.reproducible-builds.org, which performs two builds against the
current state of archive).

Implementing a workaround for the limitations of snapshot.debian.org
could move Debian beyond Reproducible Builds in *theory* and into
Reproducible Builds in *practice*!

Happy to help with this, hope to see it move forward!


To further limit the scope, one might also be able to take all the
currently relevent .buildinfo files for bullseye and build a list of the
package versions needed from that (rather than assuming 2017 as a good
baseline). Might be a little trickier to implement, of course...


live well,
  vagrant
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/reproducible-builds/attachments/20210228/edc3c0a4/attachment.sig>