https://en.opensuse.org/openSUSE:Reproducible_Builds now has instructions with the 4 rpm macros to put into a prjconf of a OBS project to allow for bit-identical reproducible builds of rpms.

I would love to see some real-world adoption of those, so we can be more confident, when we enable it later for the main openSUSE distributions.

Thus I'm looking for volunteer projects to test bit-identical reproducible builds.

In detail these 4 rpm macros are:

1 %source_date_epoch_from_changelog Y is already active in Tumbleweed and 15.0 since 2017-05 so should not make a difference.

2 %clamp_mtime_to_source_date_epoch Y is the one most likely to cause trouble. We added a patch to python to fix it for .pyc files. But there is freepascal and maybe other formats that embed mtimes and might expect them to match what other files have in the filesystem. If you find+file such issues, be sure to CC me on the bug.

3+4 %use_source_date_epoch_as_buildtime Y %_buildhost reproducible those just override rpm header fields, so they will not affect the packaged software, but there might be surprised users or scripts that handle packages and look at Build Date or Build Host fields.

Older distributions will probably just ignore these macros because its rpm does not know about it.

Please tell me, if you are interested or need help debugging/fixing issues.

If you are interested in the topic, you can also have a look at the linked resources in the wiki. E.g. theunreproduciblepackage is a fun place to start and see some surprising ways how package-builds were unreproducible.

Ciao Bernhard M.