Storing build logs outside of .deb packages

Vagrant Cascadian vagrant at reproducible-builds.org
Sun May 31 22:49:46 BST 2020


On 2020-05-17, Paul Wise wrote:
> On Sat, 2020-05-16 at 22:58 +0000, Chris Lamb wrote:
>> My gut feeling is that this is the avenue we want to explore. Having a
>> separate mechanism to capture this build-specific metadata would be an
>> elegant solution and, as you imply, having the logs would have QA
>> advantages as well as permit reproducible builds. The system could be
>> generic enough for future use-cases that we cannot envisage too.
>
> Agreed that this is the best option. In order to standardise the
> naming, structure and organisation of the data in order to make it work
> across all Debian derivatives, probably a new conversation needs to be
> started between ftp-master and the dpkg maintainer.
>
>> We have taken great pains over the years that no special knowledge,
>> tools or tricks are required to compare the artifacts of a Debian
>> build with respect to reproducibility.
>
> I'm not involved in repro builds enough so your statement leads me to
> wonder how you deal with ignoring the inevitable differences between
> the buildinfo files, which would record the inevitable differences in
> build environment between different builders.

Thanks for diving in and nudging this conversation forward!

The .buildinfo files aren't the build artifacts themselves, it's the
vehicle by which data about the resulting artifacts and the environment
used to produce them is recorded. So yes, they're not expected to be
reproducible anymore.


> I'm guessing you just ignore all differences in buildinfo files and
> would have to add to that ignoring differences between build logs and
> other build metadata?

That sounds likely, yes.


I'm not sure this belongs on the binutils bug anymore; dropped from CC.


live well,
  vagrant
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/reproducible-builds/attachments/20200531/ca145d11/attachment.sig>


More information about the Reproducible-builds mailing list