Bug#926242: jenkins.debian.org: Please test reproducibility status of Debian Installer images

[Chris Lamb]

Hey Mattia et al.,

> Does the installer need anything special?  I thought d-i was just like
> any other package when it came to regular building it.

For some reason I thought that src:debian-installer was a special-case
package (or simply used for its build-depends) and it does not
"really" build the images. Obviously, I hope you are absolutely right
and this is much easier than I thought to resolve.

(I think I got some of this preconception from various README files
which imply one should build via the Makefile, not via building
src:debian-installer.)

Thinking about it, a d-i *release* might trigger or other go through
some other codepaths — perhaps even manual ones — that might lead to
an unreproducible package.. and thus we would definitely want to
exercise these.

> If d-i is like I assume it be, there should a regular buildinfo as well,
> see https://buildinfo.debian.net/sources/debian-installer for what I
> mean.

Nod. However, we would need to double check that the src:debian-
installer .buildinfo includes or otherwise takes into consideration:

 a) The actual generated ISOs/.img/netboot images etc. and not just
    the binary packages as usual. (I mean we only really care about
    the former here, right?)

 b) Any sources downloaded directly from the archive.

As above, perhaps there is some kind of "release" codepath we need to
definitely and specifically test too? -boot can you chime in here on
this angle?

> So the reason src:debian-installer does not build at this moment [..]

For completeness (and/or people following along):

  http://tests.reproducible-builds.org/debian-installer

… specifically:

  make[2]: Entering directory '/build/1st/debian-installer-20190118/build'
  WARNING: mirror 'http://deb.debian.org/debian' appears to be invalid; skipping
  WARNING: mirror 'http://deb.debian.org/debian' appears to be invalid; skipping
  […]
  Building dependency tree...
  E: Unable to locate package acpi-modules-4.19.0-1-amd64-di
  E: Couldn't find any package by glob 'acpi-modules-4.19.0-1-amd64-di'
  E: Couldn't find any package by regex 'acpi-modules-4.19.0-1-amd64-di'
  […]

> One way to workaround this problem of src:debian-installer, would be for
> our building script to instruct pbuilder to not block the network when
> it's building this special package.

I think that's fine, especially if we add this to the log and that
it's well-commented as a magic exception. You happy to go-ahead with
this?


Best wishes,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby at debian.org 🍥 chris-lamb.co.uk
       `-