14:59:20 <h01ger> #startmeeting reproducible-builds.org monthly IRC meeting
14:59:20 <MeetBot> Meeting started Tue Mar 29 14:59:20 2022 UTC.  The chair is h01ger. Information about MeetBot at http://wiki.debian.org/MeetBot.
14:59:20 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic.
14:59:31 <h01ger> #topic welcome to this monthly meeting, please briefly introduce yourself or update us on recent or planned projects
14:59:45 <h01ger> https://pad.riseup.net/p/rb-irc-meetings-keep has the agenda
15:00:12 * h01ger is Holger Levsen, working on this and that for reproducible-builds.org - i'm also your host today :)
15:00:21 * rclobus is Roland Clobus, working on live ISO images as generated by live-build
15:00:39 * sangy is Santiago Torres-Arias. Assistant Professor at Purdue University, doing work on all things software supply chain security
15:00:40 * aparcar[m] works on OpenWrt
15:01:00 * lamby is Chris Lamb, also working on this and that, here and there, in and around Reproducible Builds and Debian :)
15:01:13 <h01ger> :)
15:01:31 * vagrantc is Vagrant Cascadian ... Reproducible Builds mostly in Debian with a hint of guix
15:02:26 * h01ger will wait til 17:05 until we really start. feel free to edit the agenda til then or to fetch a beverage or some such
15:02:44 * boklm is Nicolas, working on tor browser (reproducible) builds
15:02:44 * lamby has tea.
15:03:32 * Foxboron is Morten Linderud. F/OSS developer and working on Arch Linux
15:05:11 <h01ger> ok, lets start! if you arrived later, please still feel welcome to introduce yourself!
15:05:26 <h01ger> #topic short time slots for checkins from various projects
15:05:54 <h01ger> also, feel free to ping me to ask for such a short slot if you have exciting news about something but forgot to add it to the agenda
15:05:59 <h01ger> or just edit the agenda
15:06:16 <h01ger> #topic short time slots: Alpine Linux ( Ariadne )
15:06:35 <h01ger> Ariadne said they would be afk during the meeting so i suppose no news here.
15:07:05 <Ariadne> we're working on 3.16 release, but i have written some tools at chainguard that i hope will be used to make alpine's docker images reproducible
15:07:15 <h01ger> oh, hi! :))
15:07:24 <h01ger> & with awesome news!
15:07:44 <h01ger> chaingard is your workplace or?
15:07:50 <Ariadne> yes
15:08:00 * h01ger nods
15:08:24 <h01ger> so maybe we'll see the headline "alpine 3.16 docker releases images bit for bit reproducible"?
15:08:39 <Foxboron> Ah that would be great :)
15:08:43 <h01ger> when is that release roughly planned? this year? next week?
15:10:59 <h01ger> Ariadne: ^ ?
15:11:30 <h01ger> ok, let's assume "when it's ready" and move on ;)
15:11:52 <sangy> I guess Ariadne is afk now, or doesn't want to commit to a timeline. I believe they are quite close to something though :)
15:11:56 <kibi> https://gitlab.alpinelinux.org/alpine/tsc/-/issues/40 has goals, not dates, AFAICT
15:12:11 <h01ger> #topic short time slots: Arch Linux (jelle, Foxboron, kpcyrd)
15:12:47 <h01ger> the topic formerly also had rebuilder in it... but thats explicitly another topic
15:13:09 <Foxboron> So, Arch Linux is chugging along fine.
15:13:42 <sangy> + note there, I'd appreciate some help with the arch rebuilder @ Purdue. Anybody interested please send me an email/dm and I"d be happy to see how we can help you get the most out of it...
15:13:45 <Foxboron> We've some dip in recent percentage of reproducible packages (86% now, used to be closer to 90%) but some if infrastructure related issues. The most important part is that gcc and the toolchain is reproducible again with a new maintainer :)
15:14:11 <h01ger> #info sangy ppreciates some help with the arch rebuilder @ Purdue. Anybody interested please contact sangy
15:14:22 <Foxboron> We had some issues around the order we bootstrapped our toolchain. https://bugs.archlinux.org/task/70954
15:14:45 <h01ger> Foxboron: interesting
15:15:00 <h01ger> #info issues around the order we bootstrapped our toolchain: https://bugs.archlinux.org/task/70954
15:15:53 <h01ger> thanks for the update, Foxboron & sangy
15:16:22 <h01ger> #topic short time slots: Debian snapshot.d.o mirror status (fepitre)
15:17:00 <h01ger> afaik there are no major updates here, the mirror is running, fepitre did some work on issues reported by rclobus
15:18:03 <rclobus> snapshot.d.o is working fine for my purpose :-) The issue I reported turned out to be a non-issue.
15:18:17 <h01ger> coolio
15:18:21 <rclobus> Everything was working fine already.
15:18:43 <h01ger> #topic short time slots: Debian beta.t.r-b.o status update (h01ger)
15:19:26 <h01ger> this is running fine too, however no progress for moving to more powerful hw or improving eg the presentation layer
15:19:43 <aparcar[m]> isn't the presentation layer based on javascript?
15:19:55 <h01ger> partly yes
15:19:59 <aparcar[m]> I tried b.t.r-b.o and it was a bit sluggish
15:20:11 <aparcar[m]> what are the parts in the back? The graph generation?
15:20:50 <h01ger> aparcar[m]: https://github.com/fepitre/package-rebuilder is powering that site
15:21:32 <aparcar[m]> thanks I haven't checked that out yet
15:21:58 <aparcar[m]> are there plans to move more distros over there? (I reworked some OpenWrt rebuilder to generate a compatible JSON file)
15:21:58 * h01ger switches to the next topic, trying to incorporate feedback from the last irc meeting (to move on faster)
15:21:59 <vagrantc> having not looked at the code, the "obvious" thing would be to break it up into more fine-grained views (e.g. not all of the charts on a single page)
15:22:07 <h01ger> vagrantc: yup
15:22:23 <h01ger> #topic short time slots: Debian: live-build (rclobus)
15:22:31 <h01ger> rclobus sent another update to our mailing list
15:22:32 <rclobus> As usual, I've prepared a summary that was sent to the mailing list
15:22:36 <rclobus> #info https://lists.reproducible-builds.org/pipermail/rb-general/2022-March/002530.html
15:22:38 <h01ger> \o/
15:22:45 <rclobus> I'm currently hindered by the Python 3.10 migration in sid, it prevents new live images from being generated and Jenkins is red.
15:22:51 <vagrantc> rclobus: thanks for pounding away at all that :)
15:23:18 <rclobus> My primary focus for last month was on the functionality of the reproducible images.
15:23:22 <rclobus> For sid and bookworm I rebuild the Debian Installer images myself (the Debian archive will (nearly) always be out-of-date) and I started testing in a (local) openQA instance.
15:23:29 * sangy needs to run now, will catch up with the rest later. cheers!
15:23:31 <h01ger> cool
15:23:34 <h01ger> sangy: o/
15:23:59 <rclobus> It's good if the image is reproducible, but it should work properly as well :-)
15:24:20 * h01ger nods - anything else?
15:24:35 <rclobus> That's it from my side.
15:24:35 <vagrantc> rclobus: does each build build it's own debian-installer image? and are they coming out reproducible?
15:25:02 <rclobus> vagrantc: The debian-installer images are nearly reproducible...
15:25:32 <rclobus> They only have libgcc-s1 from the host, I'm looking into that. Everything else from from snapshot.notset.fr
15:25:58 <rclobus> :s/from from/comes from/
15:26:11 <vagrantc> thanks
15:26:16 <h01ger> #topic short time slots: FDroid ( obfusk hc _hc )
15:26:18 <kibi> rclobus: you might want to get in touch with aurel32 if you need advise in that area; he did most of the work around libc udebs in the past.
15:26:34 <rclobus> kibi: Thanks
15:26:45 * h01ger holds the line, either for more debian live stuff or FDroid updates
15:27:15 <_hc> nothing particular to report.  We just had the Guardian Project meeting here in Vienna at the magdas hotel.  It would be a nice place for the RB meeting too, if it is not too large
15:28:04 <h01ger> _hc: i'd definitly want to talk to you more about an rb meeting in vienna... (later/in a bit)
15:28:27 <h01ger> so next
15:28:35 <h01ger> #topic short time slots: rebuilder ( kpcyrd )
15:28:52 <h01ger> kpcyrd indicated they would be absent...
15:29:08 <h01ger> updates from anyone else?
15:29:29 * h01ger missed the suse topic and will move on to that in a minute
15:29:36 <aparcar[m]> I added a minor topic
15:29:59 <h01ger> aparcar[m]: noted, thanks
15:30:32 <h01ger> #topic short time slots: openSUSE ( bmwiedemann )
15:31:40 <h01ger> bmwiedemann: ?
15:32:54 * h01ger has seen many patches via the monthly blog and is supposing openSuSE is doing well
15:33:17 <h01ger> also there's a meeting coming up in Nuremberg.. maybe bmwiedemann can send us updates later on this one too
15:33:41 <h01ger> #topic short time slots: OpenWrt / reboot of rebuilder ( aparcar[m] )
15:33:47 <aparcar[m]> I gave the OpenWrt rebuilder another spin. It rebuilds the upstream provided binaries and runs diffoscope in case of issues. I'm using the GitHub CI since is free for now but since it's a python script it can run anywhere. I'd like to collaborate with someone working on b.t.r-b.o to have a nice interface for the tests. Also while working on it the diffoscope support for our uboot images is rather limited, it has a tendency of
15:33:47 <aparcar[m]> just dumping raw data rather than unpacking the contents.
15:34:18 <aparcar[m]> So working with lamby on that would be great
15:34:30 <lamby> :-)
15:34:41 <h01ger> aparcar[m]: the openwrt rebuilder is yet another rebuilder software named rebuilder? or is it based on kpcyrd's rebuilder or fepitre's rebuilder?
15:34:53 <h01ger> and YAY in the first place
15:35:10 <aparcar[m]> h01ger: it's yet another one since OpenWrt really rebuilds _everything_ on each run, not just single packages
15:35:52 <h01ger> aparcar[m]: nods
15:36:11 <aparcar[m]> I'm happy to name it differently, right now it's called openwrt-rebuilder
15:36:17 <vagrantc> i would also welcome improving uboot support in diffoscope :)
15:36:29 <h01ger> aparcar[m]: if you name it, please call it something else. rebuilderito. rebuildy. remaker. peter. maria. whatever.
15:36:45 <h01ger> openwrt-rebuilder is kinda ok, i guess ;)
15:36:53 <aparcar[m]> it's just a script, not a fancy tool like the rebuilder
15:37:05 <lamby> h01ger: lol
15:37:05 <aparcar[m]> python is just for convenience, could be shell, too
15:37:10 <h01ger> thats how they all start. and soon you have an editor and then an OS
15:37:18 <aparcar[m]> fair
15:37:26 <aparcar[m]> I'll go wither rebuilderito then
15:37:32 <h01ger> hahaha
15:38:16 <aparcar[m]> oh and another thing, I added "unsigned" checksums to our build artifacts, meaning it's now possible to compare builds even if both build hosts used different signing keys
15:38:39 <aparcar[m]> before one would download the others firmware, replace the signature etc
15:38:53 <h01ger> aparcar[m]: and then in the longer run it would be great if we can fetch the results somehow to display them under some t.r-b.o url, but thats something for later (and definitly a detail not needed to be discussed in such a meeting)
15:39:11 <aparcar[m]> yea ty for the timeslot
15:39:19 <rclobus> I've seen that patch, I was confused by the term 'unsigned'. Now I understand that it means 'before-signing'.
15:39:58 <h01ger> aparcar[m]: i find it fascinating that we now have another kind of results: unsigned, signed and normally-signed-but-now-unsigned. (and i do think they all make sense)
15:39:59 <aparcar[m]> yea there was a bit of confusion how to call it and if to put the checksum algorithm in the key itself or not, I guess I need to read a book about API design
15:40:29 <aparcar[m]> well normally_signed and unsigned should be the same
15:40:49 <vagrantc> externally signed vs. internally signed?
15:41:01 <vagrantc> detached vs. embedded signatures ...
15:41:05 <aparcar[m]> now we just have a checksum before signing and one after, meaning people who download the file use the regular one, tools checking if reproducible use the unsigned one
15:41:15 <aparcar[m]> we use embedded signatures
15:41:56 <aparcar[m]> if RB comes up with a standard like for "signatures which do not contain any intentionally unreproducible things" I'm happy to adopt it
15:42:16 <aparcar[m]> (signatures are usually intentionally unreproducible I guess)
15:42:59 <h01ger> aparcar[m]: in the past, we had two kinds of results: unsigned (easy) and signed, where we came up with the hack/solution to just reapply the 'original' sig. not because we wanted, but because projects already used those designs
15:43:38 <h01ger> eg rpm files are signed and its unrealistic to expect to be able to change that. and we want rpms to be reproducible... so we came up with that
15:43:39 <aparcar[m]> yea I implemented a signature swap too, but since we produce daily some 20GB of images, I don't want to swap them all
15:43:48 <h01ger> yeah
15:43:56 <h01ger> shall we move on to the next topic?
15:44:03 <aparcar[m]> yes plase
15:44:14 <h01ger> aparcar[m]: whats the git repo of your work on this?
15:44:17 <rclobus> Perhaps off-topic, but what _is_ required for a signature? The secret of the signer, some timestamp I guess, but does it need also some random data?
15:44:38 <aparcar[m]> https://github.com/aparcar/openwrt-rebuilder/runs/5737341581?check_suite_focus=true (not yet renamed)
15:44:42 <h01ger> rclobus: definitly the secret, so..
15:44:47 <h01ger> aparcar[m]: thanks
15:44:51 <h01ger> #save
15:45:23 <h01ger> #topic r-b summit 2022 ( mapreri )
15:45:36 <h01ger> i havent seen mapreri today on irc..
15:46:11 <h01ger> but i guess i can say we are looking at having an RB summit in september or october this year, hopefully. and in person.
15:46:36 <lamby> 🤞
15:47:15 <h01ger> having very little data i'm also confident to say that finding a location will be really hard as many many places are booked already (and we have our time constraints too, eg not in june/july/august, because too crowded already)
15:47:34 <h01ger> .
15:49:52 <h01ger> _hc: so, if you know venues in vienna, lets talk. basically you could start by asking them if they are available for any week in september or october.
15:50:23 <h01ger> i found *one* end of october in hamburg (the rest was already booked) but sadly gunner was not available that week.
15:50:33 <h01ger> where week=monday to friday
15:51:28 <h01ger> we need a space with approx 100-200m², which can be divited for four sub groups. be that with smaller extra rooms, or room divider or whatever
15:51:46 <h01ger> also happy to discuss details in more detail later
15:52:31 <h01ger> we'd also be happy about other cities as long as they are easy to reach by train and plane
15:53:22 * h01ger feels a bit crazy for talking about a RL event with people in 6 months.
15:53:31 <h01ger> (and nobody else saying a bit ;)
15:54:03 <lamby> Probably best to send a mail to the list with those requirements - will let people check things async to this meeting ^
15:54:18 <lamby> but great to raise it here :)
15:54:23 <vagrantc> hard to say much, it seems realyl hard to plan still
15:54:24 <rclobus> h01ger: You know about the requirements, now we can think about possible locations in our neighbourhoods.
15:54:28 <h01ger> right :)
15:55:22 <h01ger> oh well, then
15:55:25 <h01ger> #topic AOB
15:55:35 <aparcar[m]> what is AOB?
15:55:40 <h01ger> vagrantc: the samba bug...
15:55:45 <h01ger> aparcar[m]: any other business
15:55:51 <aparcar[m]> smart
15:55:58 <vagrantc> i was asked a question that ... i wasn't fully sure of the answer to
15:56:02 <vagrantc> https://lists.samba.org/archive/samba-technical/2022-March/137172.html
15:56:09 <_hc> h01ger: how many attendees are you thinking?
15:56:26 <h01ger> _hc: 42
15:56:41 <h01ger> _hc: 23 to 50
15:56:50 <vagrantc> basically, i proposed to add -ffile-prefix-map to the default arguments, but they asked about what to do with debug symbols ... i know debian can still get at the debug symbols, but i'm not sure if upstream would also have to do anything special to make that work
15:57:29 <vagrantc> obviously, stripping the full path out of the debug symbols would mean you need some way to find them
15:57:40 <rclobus> Aren't the debug symbols found by GNU_BUILD_ID?
15:57:40 <h01ger> vagrantc: there are automatic debug packages now but i never dove into them
15:58:08 <vagrantc> h01ger: i've used them slightly ... but can't say hugely proficiently
15:58:22 <vagrantc> and i know debian does something to make them
15:58:30 <vagrantc> make them work
15:58:46 <rclobus> #info https://wiki.debian.org/Debuginfod
15:59:01 <h01ger> vagrantc: maybe #debian-devel can help you with this question?
15:59:21 <vagrantc> specifically, i know how to use them in *debian* ... but i'm wondering what upstream would have to consider, worry about, workaround, etc.
15:59:41 <h01ger> ah
16:01:10 <vagrantc> i think debian builds with the debugging symbols, and then part of the packaging process extracts them into the separate dbgsym packages, but obviously upstream would need to do something similar
16:01:19 * h01ger is trying to come up with the right #info line, like 'vagrant is looking for help with debug flags (outside debian)'
16:01:33 <vagrantc> yeah, me to
16:01:36 <vagrantc> :)
16:01:50 <rclobus> But for regular debugging, you will most probably have a source path that it different from the source path that was used by the provider of the binary package. So you will have to point your debugger to your local source anyway.
16:02:13 <vagrantc> rclobus: yeah, that's what confuses me a bit
16:02:30 <h01ger> #info like 'vagrant is looking for help with debug flags (outside debian) - see https://lists.samba.org/archive/samba-technical/2022-March/137172.html for context
16:02:37 <vagrantc> h01ger: thanks :)
16:02:47 <h01ger> :) np
16:03:16 * h01ger has another AOB bit: i really enjoyed the mailing list discussion about r-b use cases in the real world. thanks to everyone who contributed!
16:03:25 <lamby> Yes, thanks too
16:03:43 <lamby> Still very much looking for "bad thing averted", but enjoying the thread all the same
16:04:26 <vagrantc> it is hard to find something that didn't happen because of something
16:04:44 <h01ger> :)
16:05:08 <vagrantc> maybe we turn it around ... things like X (e.g. solarwinds) will continue to happen without reproducible builds?
16:05:23 <h01ger> hah.
16:05:25 <vagrantc> (while also showing that reproducible builds is one piece in that)
16:05:48 <h01ger> any other business?
16:05:54 <vagrantc> not the magic silver bullet, etc...
16:06:53 <h01ger> any other business? :)
16:07:23 <h01ger> alright. lets wrap this up
16:07:39 <h01ger> thank you all for attending, sharing updates & lots of nice work!
16:07:59 <lamby> THanks for running the meeting, h01ger :)
16:08:00 <h01ger> hoping to see you again on the last tuesday of the month at 15 UTC, so thats april 26th!
16:08:05 <rclobus> h01ger: Thank you for hosting the meeting.
16:08:10 <h01ger> o/
16:08:10 <vagrantc> thanks all!
16:08:47 * vagrantc is hoping to maintain timezone stability for the forseeable future
16:08:58 <h01ger> #endmeeting