[Soc-coordination] GSoC 2015 Week 8: Move forward reproducible builds

[Dhole]

# 8th week

Subject: GSoC 2015 Week 8: Move forward reproducible builds
To: soc-coordination at lists.alioth.debian.org
CC: reproducible-builds at lists.alioth.debian.org

Hi,

This week I have continued working on the reproducible timestamp
approach through the exported variable SOURCE_DATE_EPOCH.

I studied the issue lc_messages_randomness [1], which is caused by the
tool xgettext in the package gettext. The packages affected have a
timestamp embedde with the creation date of .po translation files, which
is later transferred to .mo translation files.
I wrote a patch for gettext so that xgettext replaces localtime
timestamps with the date found in SOURCE_DATE_EPOCH in case it is set.
The branch with the changes in the reproducible git repo can be found here:
https://anonscm.debian.org/cgit/reproducible/gettext.git/log/?h=pu/reproducible_builds

I also uploaded the gettext package with these changes and uploaded to
the reproducible builds APT repository, to test on jenkins, which gave
the following results:

There were 42 unreproducible packages affected by this issue, of which
27 became reproducible.
15 packages are still not reproducible because the call to xgettext
doesn't happen under dh.

I also opened a bug in Debian providing the patch and updated the wiki
about our experimental toolchain.
    https://bugs.debian.org/792687

I have also worked on individual packages affected by the issue
timestamps_difference_by_unzip [2] where 11 packages are affected (9
unreproducible).

Out of those 9, I wrote patches for 7 to make them reproducible:

- fonts-stix
    https://bugs.debian.org/792602
- jsmath
    https://bugs.debian.org/792596
- jsmath-fonts-sprite
    https://bugs.debian.org/792597
- libreoffice-canzeley-client
    https://bugs.debian.org/792598
- openthesaurus
    https://bugs.debian.org/792599

There are 2 packages missing: pdf.js and torbutton, which don't become
reproducible with the same procedure as the ohter ones. I'll study them.

I also sent patches to two other packages:
lives (process a Perl hash in stable order to make it reproducible)
    https://bugs.debian.org/792593

dict-jargon (affected by timestamps_in_dictionaries)
https://bugs.debian.org/792709

For next week I plan to look further into pdf.js and torbutton, try to
patch the remaining packages affected by timestamps_in_dictionaries, and
work on the issue pdf_created_by_ghostscript [3].


[1]
https://reproducible.debian.net/issues/unstable/lc_messages_randomness_issue.html
[2]
https://reproducible.debian.net/issues/unstable/timestamps_difference_by_unzip_issue.html
[3]
https://reproducible.debian.net/issues/pdf_created_by_ghostscript_issue.html

Best regards,
Dhole

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/soc-coordination/attachments/20150720/21e70868/attachment-0001.sig>