Wiki

• FrontPage
• RecentChanges
• FindPage
• HelpContents
• ReproducibleBuilds

It should be possible to reproduce, byte for byte, every build of every package in Debian. More information about reproducible builds in general are available at reproducible-builds.org.

Status

• Most packages built in sid today are reproducible under a fixed build-path and environment.

• We have a new control file *.buildinfo that records the build environment, see deb-buildinfo for reference. Older design drafts are here.

• We have a continuous integration platform that builds and immediately rebuilds packages. With this we can detect problems related to timestamps, file ordering, CPU usage, (pseudo-)randomness and other things.

• We are examining packages and sorting out common problems.

• Many patches have already been submitted, and we are continuously writing new ones.

• You can check which packages installed on your system are still unreproducible by using the reproducible-check script in the devscripts package.

Big outstanding issues

These are the critical items necessary to have reproducible builds for at least the required packages of Debian

/reproducible-builds/debian-rebuilder-setup/blob/master/builder/srebuild has another variant

• #763822: ftp.debian.org: please include .buildinfo file in the archive, with this two related bugs:

  • #862073: ftp.debian.org: Please POST .buildinfo files to buildinfo.debian.net

  • #862538: security.debian.org: Please POST .buildinfo files to buildinfo.debian.net

• #894441: binNMUs should be replaced by easy "no-change-except-debian/changelog-uploads" (as of 20190302, 12% of all binaries in Buster were binNMUs.)

• User-facing interfaces (see proof-of-concept in #863622: apt: warn when installing packages that are not reproducible

• #900837: Mass-rebuild of packages for reproducible builds (blocked by #894441) -

• Currently debian-policy says "packages should be reproducible", though we aim for "packages must be reproducible" though it's still a long road until we'll be there: currently (Oct 2018) there are more than 1250 unreproducible packages in Buster, thus if policy would be changed today, 1250 packages would need to be kicked out of Buster (well, or fixed) immediatly, so this policy change right now is not feasible.

debrebuild issues

• #955049 debrebuild: no manpage and no --help option

• #955050 debrebuild: please accepted signed .buildinfo files

• #955307 debrebuild: should avoid downgrades

• #961862 debrebuild: should assemble the source for binNMUs

• #961864 debrebuild: creates wrong commandline for binNMUs

• #969098 debrebuild: fails to download some packages from snapshot.d.o

• #955123 debrebuild: please provide --sbuild-output-only option

• #955304 debrebuild: suggested sbuild command should use --no-run-lintian

• #955308 debrebuild: also explain *how* to use snapshot.d.o

• #958750 debrebuild: please add --standalone mode or --one-shot-mode

• #961861 debrebuild: should (optionally) download the source too

• #964722 debrebuild: please add option for rebuilding in the same path

• #970095 debrebuild, sbuild: unsat-dependency: binutils:amd64 (= 2.35-1) while the package is on snapshot.d.o

Annoying but not major

• #869184: dpkg: source uploads including _amd64.buildinfo cause problems

• #802241: dpkg: please store the hash of the installed .deb and allow to query it

• #969084: buildd.d.o: please don't use a tainted buildenv

Nice to have

• Tighten up the Policy definition of "reproducible" to be stricter about environment variables and build paths.

• Discuss which environment variables we should blacklist or whitelist, 876055.

• #929397: ftp.d.o: please upload LTS .buildinfo files to ftp-master (this is not relevant yet, as Jessie is the LTS release, while only dpkg from Stretch and newer produces .buildinfo files.)

Also related

• #895346 [devscripts] devscripts: dcmd --buildinfo is not documented

• #869567 [devscripts] debsign: doesn't sign multiple .buildinfo in the same changes

• #898961 [devscripts] dscverify: accept .buildinfo from a build with unsigned .dsc which later was signed

• #807270 [devscripts] mk-origtargz: create reproducible tarballs and --mtime option

• #852365 [sbuild] sbuild: append-to-version may overwrite incorrect .buildinfo

• #923987 [sbuild] Should also send the buildinfo in the build mail

There are many other possible nice-to-haves, e.g., making builds independent of their build directory, making it possible to create archive formats (like tar.gz and zip) with different tools yet result in the same byte order, etc. Many of those are valuable, but they shouldn't distract from getting the results of reproducible builds out to users.

Even more

For more concrete tasks to be done, look at how to contribute.

Solved issues

• #964733 debrebuild: parsable output

• #955051 debrebuild: Build-Architecture fields are optional but debrebuild mandates them

• #955280 debrebuild: please stop using the reproducible-builds.org apt repo

• #955298 debrebuild: please switch from httpredir.d.o to deb.d.o

• #774415 devscripts: please add the srebuild wrapper for reproducible builds

• #900918: debian-installer: Please make the generated images reproducible, see also #920631 and #920676

• #844431: debian-policy: packages should build reproducible

• many more we fixed between 2014 and 2019, when this section was created. Hopefully some like those in dpkg will be added here eventually.

CategoryDeveloper CategoryPackaging