OBS and reproducible builds verification
Hi, I am still working on verifying as many openSUSE package binaries as possible and openSUSE:Factory often gives me trouble. 1) One aspect is that prjconf changes over time and building identical sources with identical BuildRequires binaries can then yield different reults. Part of the solution was implemented in https://github.com/openSUSE/open-build-service/issues/10020 2) there are some binaries involved in builds that are not published. examples include yast2-schema borgmatic that pull in systemd-mini, udev-mini and their subpackages. Some of the trouble might be because Factory does not do full rebuilds. Would it help break rebuild cycles, if OBS knew which packages dont build reproducibly? E.g. atm for Ring0/bootstrap: bison, gcc10, python38 I workarounded this one for now by manually substituting the missing rpms with older openSUSE:Factory/standard/x86_64/systemd-mini-devel-246.9-1.1.x86_64.rpm and friends. 3) for example our terminator package I cannot do a verification build here, because when I supply old binaries to osc build -p deps OBS complains unresolvable: have choice for python3-attrs >= 17.4.0 needed by python3-pytest: python3-attrs python38-attrs Is there a way to have osc build with only the supplied local old binaries and nothing pulled from OBS? Ciao Bernhard M.
On Montag, 22. Februar 2021, 10:59:45 CET Bernhard M. Wiedemann wrote:
Hi,
I am still working on verifying as many openSUSE package binaries as possible and openSUSE:Factory often gives me trouble.
1) One aspect is that prjconf changes over time and building identical sources with identical BuildRequires binaries can then yield different reults. Part of the solution was implemented in https://github.com/openSUSE/open-build-service/issues/10020
yes, osc part is still missing. But it is on our list.
2) there are some binaries involved in builds that are not published. examples include yast2-schema borgmatic that pull in systemd-mini, udev-mini and their subpackages. Some of the trouble might be because Factory does not do full rebuilds. Would it help break rebuild cycles, if OBS knew which packages dont build reproducibly? E.g. atm for Ring0/bootstrap: bison, gcc10, python38
I workarounded this one for now by manually substituting the missing rpms with older openSUSE:Factory/standard/x86_64/systemd-mini-devel-246.9-1.1.x86_64.rpm and friends.
hm, decision of the release manager, so you need to ask there, but ...
3) for example our terminator package I cannot do a verification build here, because when I supply old binaries to osc build -p deps OBS complains unresolvable: have choice for python3-attrs >= 17.4.0 needed by python3-pytest: python3-attrs python38-attrs
Is there a way to have osc build with only the supplied local old binaries and nothing pulled from OBS?
... this is in general not possible with Factory. This is cause by the combination of a) No transitive build mode is used there. So a package many not get rebuild when a build dependency is changing. b) Tumbleweed is rolling release. So old binaries will not be kept. IMHO it is hopeless to get reproducible builds in Factory atm, with it's current setup. I would focus on Leap distributions where these problems do not exist. -- Adrian Schroeter <adrian@suse.de> Build Infrastructure Project Manager SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany (HRB 247165, AG München), Geschäftsführer: Felix Imendörffer
participants (2)
-
Adrian Schröter -
Bernhard M. Wiedemann