Search results for

[opensuse-factory] openSUSE reproducible builds status 2021-10

by Bernhard M. Wiedemann

Hi, again I could not spend much time on reproducible builds this month, but I hope, there will be more time next month to catch up a bit. last month's status: https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/message… Last months' reproducible builds project updates (including my work): https://reproducible-builds.org/reports/2021-09/ I uploaded https://rb.zq1.de/compare.factory-20211031/ today and rbstats are: total-packages: 14212 (+59) build-tried: 14181 (+58) build-failed: 48 (+9) build-n-a: 288 (-4) build-succeeded: 13847 (+55) build-official-failed+na: 691 (+524) build-compare-failed: 395 (+9) build-compare-succeeded: 13452 (+46) verify-failed: 455 (-7) verified-semi-reproducible: 13178 (-16) bit-by-bit-identical: 13374 (+80) not-bit-by-bit-identical: 473 (-27) not-bit-by-bit-identicalcheck: 473 (-25) https://rb.zq1.de/compare.factory-20211031/graph.png shows the change over time https://rb.zq1.de/compare.factory-20211031/unreproduciblerings.txt lists very unreproducible core packages (bootstrap+DVD) Of the badly unreproducible packages, 4 were in ring0 35 were in ring1 That makes it 39/3247 => 1.20 % which is below the overall average of 395/13847 => 2.85 % 473/13847 => 3.42 % of packages are not perfectly reproducible Newly reproducible core packages: podman Ciao Bernhard M.

3 years

Re: enabling reproducible builds in Factory and ALP

by Jan Zerebecki

On 15/03/2024 12.11, Neal Gompa wrote: > On Fri, Mar 15, 2024 at 1:31 AM Bruno Pitrus <brunopitrus(a)hotmail.com> wrote: >> >> Will this help in getting build-compare enabled in the Fedora repos? (bsc#1206734) Last time i tried to test this, it was broken because of the changing build-id files. Bruno, either way trying again might be worthwhile. Please comment on the bug if you do. Reproducible builds in general should be helpful, but my guess is, that this specific change might not be necessary for build-compare to work. This change is only for Factory and anything that inherits from it. While Tumbleweed is built this way, things that inherit from Tumbleweed will not have it enabled by default yet, but you can do that by using the settings listed on https://en.opensuse.org/openSUSE:Reproducible_Builds . Enabling it for a project that inherits from Fedora is more complicated as the script to pass some environment variables from OBS to rpm isn't included there: https://github.com/openSUSE/post-build-checks/pull/62 But as before, I guess that is not necessary for your use case. > Not unless build-compare is set up to filter out certain RPM header > tags that are intentionally non-reproducible (build host, build time, > rpm signature, and a few others). build-compare is to do just that: To filter out known types of changes that are considered the same in packages that are not fully bit-wise reproducible. > I am not aware of randomly changing build-id files on anything except > Go software, and that's been fixed: > https://pagure.io/go-rpm-macros/c/1980932bf3a21890a9571effaa23fbe034fd388d While this macro uses SOURCE_DATE_EPOCH, it will still work without it, and thus without the change I announced. > With my Fedora hat on, I can say there has been a reproducible builds > effort that's been active for years, but the difference is that we are > not following Debian's exact definition of it, because it is not fully > applicable for Fedora (or indeed most RPM distributions). > > More details are on the effort website: > https://docs.fedoraproject.org/en-US/reproducible-builds/ From my reading your link contradicts what you are saying. It says it uses the exact same definition, bit-by-bit. That it is applicable to Fedora. It recognizes that even getting part of the way there is useful. Which Debian did also, as it took a long time for packages to be build reproducible by default in Debian. It links to the rpm upstream discussions where I argue for improving support for this in rpm. Now in Factory we have bit-by-bit reproducibility except for the signature. (Though there is still a regression in rpmsign when deleting the signature adds zeros https://github.com/rpm-software-management/rpm/issues/2965 which needs to be fixed to be able to do the bit wise compare of two builds.) Where I disagree with the text at the link is that I think in the future, step by step we should get to full bit-by-bit reproducible rpms. But making packages reproducible in all the other ways should not wait on that. > 真実はいつも一つ！/ Always, there's only one truth! Modern science as written about by Karl Popper (see keywords falsifiability, critical rationalism), shares the idea that only one truth exists. With the caveat that humans have no way to detect the one truth, but they can detect what is not true. So humans can learn from what they recognized as not true. Science requires reproducibility. -- Best regards, Jan Zerebecki

8 months

[opensuse-factory] openSUSE reproducible builds status 2021-02

by Bernhard M. Wiedemann

Hi, last month's status: https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/… Last months' reproducible builds project updates (including my work): https://reproducible-builds.org/reports/2021-01/ I uploaded https://rb.zq1.de/compare.factory-20210227/ today and rbstats are: total-packages: 13909 (-20) build-tried: 13900 (-22) build-failed: 81 (+51) build-n-a: 135 (+5) build-succeeded: 13684 (-78) build-official-failed+na: 393 (+99) build-compare-failed: 433 (-3) build-compare-succeeded: 13251 (-75) verify-failed: 497 (-11) verified-semi-reproducible: 12871 (-75) bit-by-bit-identical: 13119 (-79) not-bit-by-bit-identical: 565 (+1) not-bit-by-bit-identicalcheck: 565 (+1) https://rb.zq1.de/compare.factory-20210227/graph.png shows the change over time https://rb.zq1.de/compare.factory-20210227/unreproduciblerings.txt lists very unreproducible core packages (bootstrap+DVD) Of the badly unreproducible packages, 3 were in ring0 45 were in ring1 That makes it 48/3247 => 1.48 % which is below the overall average of 433/13684 => 3.16 % 565/13684 => 4.13 % of packages are not perfectly reproducible newly unreproducible core packages: containerd: becomes reproducible with BuildRequires: go1.15 https://github.com/golang/go/issues/42159 python-numpy: .pyc files are nondeterministic again/still newly reproducible core packages: kopete: might still be affected by https://bugreports.qt.io/browse/QTBUG-83186 but 1-bit nondeterminism can go unnoticed rubygem-nokogiri darix fixed https://bugzilla.opensuse.org/show_bug.cgi?id=1180528

3 years, 8 months

[opensuse-factory] openSUSE reproducible builds status 2019-11

by Bernhard M. Wiedemann

Hi, last month's status: https://lists.opensuse.org/opensuse-factory/2019-10/msg00367.html Last months' reproducible builds project updates (including my work): https://reproducible-builds.org/reports/2019-10/ I uploaded https://rb.zq1.de/compare.factory-20191129/ today and rbstats are: total-packages: 12424 (+152) build-tried: 12416 (+152) build-failed: 51 (-23) build-n-a: 81 (-2) build-succeeded: 12284 (+177) build-official-failed+na: 126 (-93) build-compare-failed: 415 (+19) build-compare-succeeded: 11869 (+158) verify-failed: 560 (-18) verified-semi-reproducible: 11608 (+171) verified-bit-identical: 0 bit-by-bit-identical: 11481 (+163) not-bit-by-bit-identical: 794 (+13) https://rb.zq1.de/compare.factory-20191129/graph.png shows the change over time https://rb.zq1.de/compare.factory-20191129/unreproduciblerings.txt lists very unreproducible core packages (bootstrap+DVD) Of the badly unreproducible packages, 2 were in ring0 48 were in ring1 That makes it 50/2901 => 1.72 % which is below the overall average of 415/12284 => 3.38 % 794/12284 => 6.46 % of packages are not perfectly reproducible This month, I added https://github.com/apache/felix/pull/209 as a test patch in https://build.opensuse.org/package/show/home:bmwiedemann:reproducible:test/… and in addition with last month's https://build.opensuse.org/request/show/735873 that made it possible to build some dozen java packages reproducible by applying tweaks (e.g. use strip-nondeterminism and replace /dev/*random with /dev/zero to counter random maven UUIDs) On the unreproducible core package list, we have branding-openSUSE variations in .jpg files tomcat filesystem ordering issues and probably others python-python-xlib one .pyc file with timestamp newly reproducible core packages: nvme-cli from a gcc9 LTO patch = https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91307 python-tox from the https://bugzilla.opensuse.org/show_bug.cgi?id=1094323 toolchain patch And in the next week I am off to the reproducible-builds world summit. Ciao Bernhard M.

4 years, 11 months

[opensuse-factory] openSUSE reproducible builds status 2019-04

by Bernhard M. Wiedemann

Hi, last month's status: https://lists.opensuse.org/opensuse-factory/2019-03/msg00362.html Last months' reproducible builds project updates (including my work): https://reproducible-builds.org/blog/posts/204/ https://reproducible-builds.org/blog/posts/205/ https://reproducible-builds.org/blog/posts/206/ They are currently switching to monthly reports with the 2019-04 one still in progress. I uploaded https://rb.zq1.de/compare.factory-20190429/ today and rbstats are: total-packages: 11721 build-tried: 11720 build-failed: 70 build-n-a: 111 build-succeeded: 11539 build-official-failed+na: 123 build-compare-failed: 290 build-compare-succeeded: 11249 verified-semi-reproducible: 9719 verified-bit-identical: 0 bit-by-bit-identical: 10933 not-bit-by-bit-identical: 598 https://rb.zq1.de/compare.factory-20190429/graph.png shows that the last weeks had pretty little change. The 'verified-semi-reproducible' number went up because I was able to build most packages with older Tumbleweed binaries thanks to https://lizards.opensuse.org/2019/04/03/experimental-opensuse-mirror-via-ip… There are still some Tumbleweed binaries from before February that cannot be reproduced due to missing build deps. Of the badly unreproducible packages, 5 were in ring0 41 were in ring1 That makes it 46/2901 => 1.59 % which is below the overall average of 290/11539 => 2.51 % Fixed core packages since last month: gimp jing-trang from improved build-compare many python modules from restored python3 byte_compile sort patch Newly unreproducible core (DVD) packages: branding-openSUSE parallelism race causes 5120x3200.jpg to go missing silently already fixed in https://github.com/openSUSE/branding/pull/111 libqt5-qttools filesystem readdir order via qttools-everywhere-src-5.11.2/src/designer/src/lib/.rcc/qrc_SmartPhoneWithButtons.cpp maybe from cd src/designer/src/ && qmake -o Makefile src.pro Also, tchvatal looked into libreoffice and found some unreproducible .zip files (named .jar and .bau) Ciao Bernhard M.

5 years, 6 months

Re: x86_64 architecture level requirements, x86-64-v2 for openSUSE Factory

by Neal Gompa

On Thu, Aug 11, 2022 at 1:44 AM Gerald Pfeifer <gp(a)suse.com> wrote: > > On Wed 2022-08-10, cagsm wrote: > > are varios distros not as well trying to attempt to go for reproducible > > builds? this would need to implement the counter-checking on the users > > hardware anyways, or am i misunderstanding the reproducible-builds > > stuff? > > The point of reproducible builds is that they are reproducible > which (ideally) means identical. > > Building on local systems with "random" compiler flags goes against > that and opens a different can of worms. I am not saying it doesn't > have benefits, and some are really interested in that. It's just > something different than what openSUSE distros aim for - which > includes ease of consumption. > Reproducible builds (as Debian defines them) have a weaker value proposition when the distribution doesn't accept binary builds from random computers into the repositories that could be built any which way. If you have total control of the inputs used to do the build, and have the ability to replay build environments (which not all distros have the ability to do), then specifically spending *more* time on this is not as important. That's why Debian and openSUSE spend time on this, while you don't see Fedora doing it so much, for example. That's not to say they don't *care* about reproducible builds, but that the motivation to do more is significantly lessened due to what they already have. And like Gerald said, screwing around with build flags violates reproducible builds too. :) -- 真実はいつも一つ！/ Always, there's only one truth!

2 years, 3 months

[opensuse-factory] openSUSE reproducible builds status 2021-09

by Bernhard M. Wiedemann

Hi, last month's status: https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/message… Last months' reproducible builds project updates (including my work): https://reproducible-builds.org/reports/2021-08/ I uploaded https://rb.zq1.de/compare.factory-20210930/ today and rbstats are: total-packages: 14153 (+26) build-tried: 14123 (+25) build-failed: 39 (+14) build-n-a: 292 (+77) build-succeeded: 13792 (-66) build-official-failed+na: 167 (+52) build-compare-failed: 386 (+13) build-compare-succeeded: 13406 (-79) verify-failed: 462 (-7) verified-semi-reproducible: 13194 (+68) bit-by-bit-identical: 13294 (+73) not-bit-by-bit-identical: 500 (-128) not-bit-by-bit-identicalcheck: 498 (-139) https://rb.zq1.de/compare.factory-20210930/graph.png shows the change over time https://rb.zq1.de/compare.factory-20210930/unreproduciblerings.txt lists very unreproducible core packages (bootstrap+DVD) Of the badly unreproducible packages, 4 were in ring0 38 were in ring1 That makes it 42/3247 => 1.29 % which is below the overall average of 386/13792 => 2.80 % 500/13792 => 3.63 % of packages are not perfectly reproducible I have been busy with other work, so not much progress on openSUSE reproducible builds. Newly unreproducible core packages: * openssl-1_0_0 * librsvg Ciao Bernhard M.

3 years, 1 month

[opensuse-factory] openSUSE reproducible builds status 2020-01

by Bernhard M. Wiedemann

Hi, last month's status: https://lists.opensuse.org/opensuse-factory/2019-12/msg00174.html Last months' reproducible builds project updates (including my work): https://reproducible-builds.org/reports/2019-12/ This month saw a bit less activity, but all python modules suffering from https://bugzilla.opensuse.org/show_bug.cgi?id=1094323 got a SR And https://build.opensuse.org/request/show/766399 should make various doxygen docs reproducible again (alsa, fltk, hwinfo). I uploaded https://rb.zq1.de/compare.factory-20200127/ today and rbstats are: total-packages: 12569 (+11) build-tried: 12560 (+10) build-failed: 37 (-12) build-n-a: 82 (+3) build-succeeded: 12441 (+19) build-official-failed+na: 120 (+20) build-compare-failed: 393 (+13) build-compare-succeeded: 12048 (+6) verify-failed: 543 (-7) verified-semi-reproducible: 11671 (-85) verified-bit-identical: 0 (+0) bit-by-bit-identical: 11665 (+3) not-bit-by-bit-identical: 773 (+16) https://rb.zq1.de/compare.factory-20200127/graph.png shows the change over time https://rb.zq1.de/compare.factory-20200127/unreproduciblerings.txt lists very unreproducible core packages (bootstrap+DVD) Of the badly unreproducible packages, 2 were in ring0 45 were in ring1 That makes it 47/2901 => 1.62 % which is below the overall average of 393/12441 => 3.16 % 773/12441 => 6.21 % of packages are not perfectly reproducible Ciao Bernhard M.

4 years, 9 months

[opensuse-factory] openSUSE reproducible builds status 2019-03

by Bernhard M. Wiedemann

Hi, last month's status: https://lists.opensuse.org/opensuse-factory/2019-02/msg00599.html Last months' reproducible builds project updates (including my work): https://reproducible-builds.org/blog/posts/200/ https://reproducible-builds.org/blog/posts/201/ https://reproducible-builds.org/blog/posts/202/ https://reproducible-builds.org/blog/posts/203/ I started https://raw.githubusercontent.com/bmwiedemann/reproducibleopensuse/devel/ho… as a preparation for my openSUSE conference session. I uploaded https://rb.zq1.de/compare.factory-20190326/ today and rbstats are: total-packages: 11547 build-tried: 11546 build-failed: 79 build-n-a: 107 build-succeeded: 11360 build-official-failed+na: 175 build-compare-failed: 289 build-compare-succeeded: 11071 verified-semi-reproducible: 9396 verified-bit-identical: 0 bit-by-bit-identical: 10777 not-bit-by-bit-identical: 579 The new "verified" lines are about comparison of the official build results with what I got through my local "nachbau" build. Official builds do not normalize mtimes, so no bit-identical reproduction is possible there. The number is a bit higher now, because old 2018 results have been re-checked. Need to build with the proper old binaries to get even better results. Of the badly unreproducible packages, 5 were in ring0 47 were in ring1 That makes it 52/2811 => 1.85 % which is below the overall average of 289/11535 => 2.51 % Fixed core packages since last month: pcp via https://build.opensuse.org/request/show/682435 Nearly fixed core packages since last month: libqt5-qtquickcontrols qt-5.12.3 will have the fix https://bugreports.qt.io/browse/QTBUG-74532 Newly unreproducible core (DVD) packages: libqt5-qtscript from filesystem order via Qt's rcc -name context2d context2d.qrc -o .rcc/qrc_context2d.cpp many python modules because https://github.com/python/cpython/pull/8057 was dropped from our python3 package this is very annoying and steals focus from other issues. Ciao Bernhard M.

5 years, 7 months

[opensuse-factory] reproducible builds status 2022-03

by Bernhard M. Wiedemann

Hi, this month, I had to spend more time outside of reproducible builds but I still managed to make a few nice patches and bug-reports. We had 2 toolchain issues affecting many packages. https://bugzilla.opensuse.org/show_bug.cgi?id=1197484 was already fixed but https://bugzilla.opensuse.org/show_bug.cgi?id=1197780 is still open last month's status: https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/… Last months' reproducible builds project updates (including my work): https://reproducible-builds.org/reports/2022-02/ I uploaded https://rb.zq1.de/compare.factory-20220331/ today and rbstats are: total-packages: 14352 (-19) build-tried: 14340 (-14) build-failed: 23 (-5) build-n-a: 171 (-2) build-succeeded: 14146 (-7) build-official-failed+na: 81 (-10) build-compare-failed: 495 (+87) build-compare-succeeded: 13651 (-94) verify-failed: 439 (-14) verified-semi-reproducible: 13184 (-80) bit-by-bit-identical: 13395 (-249) not-bit-by-bit-identical: 760 (+240) not-bit-by-bit-identicalcheck: 751 (+242) https://rb.zq1.de/compare.factory-20220331/graph.png shows the change over time https://rb.zq1.de/compare.factory-20220331/unreproduciblerings.txt lists very unreproducible core packages (bootstrap+DVD) Of the badly unreproducible packages, 3 were in ring0 56 were in ring1 That makes it 59/3339 => 1.77 % which is below the overall average of 495/14146 => 3.50 % 760/14146 => 5.37 % of packages are not perfectly reproducible Ciao Bernhard M.

2 years, 7 months

openSUSE Factory search results for query "reproducible-builds"