[Reproducible-builds] Bug#805321: Bug#805321: debian-installer: builds unreproducible netboot images

[Cyril Brulebois]

Hi,

Steven Chamberlain <steven at pyro.eu.org> (2015-11-22):
> I rewrote the patches according to KiBi's feedback and they are
> now uploaded to our jessie-kfreebsd suite, and this Git branch:
> https://anonscm.debian.org/cgit/d-i/debian-installer.git/log/?h=jessie-kfreebsd

I've cherry-picked 3 patches from there onto master locally and I'm
currently running diffoscope to see how that goes (and it's taking
ages…):
  c182491b05fec16497f2bf1290cac16773d175f9
  5d59fd1813e794d0821c00757dd56fd9ca25ed16
  d126622567cfbe10d7f8a207a292eaab622ef73e

> In my own testing on ZFS, file ordering was still an issue for the
> makefs tool that builds the initrd.  But if I were to try again
> on UFS, I hope to be able to reproduce the entire
> netboot-installer-images tarball as built by the buildds.
> 
> This tarball includes bits that are bundled onto the official release
> images by debian-cd tools.  Making this reproducible is a prerequisite
> for someday having reproducibly-built official release images.
> 
> I could merge these patches into sid if they seem okay?  The only
> commit that should not be merged is this one, which is specific to
> jessie-kfreebsd and must be slightly changed for sid:
> 	kfreebsd: use makefs -T to clamp timestamps

I suppose your time is better spent actually working on kfreebsd so
that's why I decided to cherry-pick the patches myself.

FWIW, I'm not exactly entirely convinced by the exporting of the
SOURCE_DATE_EPOCH variable from debian/rules; all other variables have
been passed without exporting so I'm wondering if we shouldn't adapt
this to behave like other variables, reducing possible surprise for
users.

I don't think that's a showstopper for a push to master though; just
thinking out loud.

> I expect that Linux d-i builds will have some reproducibility issues
> in whatever generates the initrd or ISOs, but I may look into that
> after the jessie-kfreebsd release is done.

Sure thing, thanks again!

Mraw,
KiBi.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.alioth.debian.org/pipermail/reproducible-builds/attachments/20151126/820668f4/attachment.sig>