[Reproducible-builds] Bug#819194: dpkg-buildflags: please add normalizedebugpath to reproducible feature set

[Daniel Kahn Gillmor]

On Tue 2016-03-29 21:52:53 -0400, Holger Levsen wrote:
> it's surely progress on the gcc/clang side of things but dropping the
> build path from the .buildinfo files would be a huge step *backwards*
> for reproducibility…

No one is arguing for dropping the build path from .buildinfo files.

As we discussed at the reproducible summit, .buildinfo files serve two
purposes:

 0) they document the environment used during a specific build, to a
    level of detail that should make it at least possible to reproduce
    the build.

 1) they also document things that should *not* be necessary to
    reproduce the build, but might be under some circumstances, or for
    some packages.

I think the build path falls into category (1) here.

In an ideal scenario, we could have two buildinfo files with variations
on the build environment (buildpath, minor versions of build-deps, etc)
and *still* have reproducible binary outputs.  This would let us know
that the variations in question are not things that cause variation in
the output.

> Also, c/c++ packages today only make up a small portion of the archive.
> Probably this famous someone should do a rebuild of the archive, using
> our toolchain (and this patch), using arbitrary build pathes.

yes, that would be great!

     --dkg