14:59:15 <h01ger> #startmeeting #reproducible-builds August 2022
14:59:15 <MeetBot> Meeting started Tue Aug 30 14:59:15 2022 UTC.  The chair is h01ger. Information about MeetBot at http://wiki.debian.org/MeetBot.
14:59:15 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic.
14:59:22 <h01ger> hi!
14:59:32 <h01ger> as usual, the agenda is at https://pad.riseup.net/p/rb-irc-meetings-keep
14:59:49 <h01ger> #topic please say hi, introduce yourself or otherwise indicate your presence
15:00:32 <h01ger> Ariadne: jelle: fepitre[m]: rclobus: _hc: bmwiedemann: aparcar: are you there or shall we skip your short time slot from the agenda?
15:00:39 * rclobus is Roland Clobus, (still) working on the live images
15:00:41 * lamby is Chris Lamb
15:00:50 * lamby is working on all reproducibles!
15:01:01 * h01ger is Holger Levsen, currently working on reproducible irc meetings ;)
15:01:07 * kushal is Kushal Das
15:01:29 <h01ger> (and failing a bit in sending reminders on time. so thanks rclobus for reminding me to do that!)
15:01:31 <raboof[m]> hi! Arnout Engelen, working on Nix/NixOS, JVM, and random other things ;)
15:02:12 <hannesm> hi, I'm Hannes Mehnert, working on MirageOS and OCaml (plus reproducible builds thereof) -- https://builds.robur.coop is what we have (rolling reproducible releases)
15:02:22 <jelle> h01ger: yes pls
15:02:32 * h01ger gives people two more minutes for this topic (though feel free to say hi later)
15:02:46 <jelle> as in, skipping is fine h01ger :)
15:02:54 <h01ger> jelle: hah
15:04:00 <mapreri> hello hello!
15:04:40 * mapreri is Mattia Rizzolo, also working on random things here and there (mostly Debian-centered, however)
15:05:57 <h01ger> allright, lets start for real then!
15:06:09 <h01ger> #topic short time slots for checkins from various projects:
15:06:47 <h01ger> it seems Ariadne is not there, so we are skipping the Alpine Linux topic. If you are there, please indicate this, so we can come back to this topic later!
15:06:51 * bmwiedemann is Bernhard M. Wiedemann, working for SUSE on openSUSE reproducible builds
15:07:16 <h01ger> jelle is there but doesnt want to talk about Arch Linux :)
15:07:48 <h01ger> #topic Debian: snapshot.d.o mirror status update
15:08:22 <h01ger> fepitre[m]'s mirror (notset.fr) is down due to him moving and snapshot.r-b.o is not yet up because i got distracted again and again
15:08:41 <h01ger> so to sum up: no news here
15:09:20 <rclobus> Have you managed to transfer that 6TB?
15:09:51 <h01ger> 6tb we habe on snapshot.r-b.o
15:09:57 <h01ger> 4
15:10:01 <h01ger> sorry
15:10:30 <rclobus> So the data is there, it 'only' (TM) is the interface that is missing?
15:10:45 <h01ger> some data and yes
15:11:17 <rclobus> Ok. Thanks.
15:11:21 <h01ger> #topic Debian: rebuilder/rebuilds
15:11:50 <h01ger> during bornhack i was reminded that docker.debian.net offers reproducible debian docker images
15:11:57 <h01ger> so i tried to rebuild them
15:12:10 <lamby> oh neat
15:12:25 <rclobus> 'tried' is the keyword?
15:12:31 <h01ger> which lead to https://github.com/debuerreotype/docker-debian-artifacts/issues/169 " instructions on docker.debian.net incomplete? #169 "
15:12:52 * h01ger discovered podman and is not using docker, fwiw & "btw"
15:13:14 <bmwiedemann> podman is nicer indeed.
15:13:15 <h01ger> those images are build using debuerreotype
15:13:38 <h01ger> and then josch told me, mmdebstrap can also create reproducible podman/docker/whatever container
15:13:48 <Ariadne> (i’m in a meeting sorry)
15:13:51 <h01ger> so i tried to rebuild those, and succeeded
15:13:57 <h01ger> Ariadne: hi & np!
15:14:24 <h01ger> so i setup jenkins jobs, to test the reproducibility of creating unstable, bookworm and bullseye containers with mmdebstrap
15:14:40 <h01ger> and then i did the same for debootstrap and cdebootstrap
15:15:00 <lamby> (hey Ariadne)
15:15:21 <h01ger> they all work(!) as in they all create reproducible debian minimal installation tar archives
15:15:37 <h01ger> .
15:15:52 <mapreri> \o/
15:15:57 <h01ger> (and no progress on the package rebuilder, also because that requires snapshot.r-b.o first)
15:16:22 <rclobus> How are you able to create reproducible images for sid with a specific timestamp?
15:16:31 * h01ger has nothing to add to this topic though of course happy to answer questions
15:16:36 <mapreri> (I saw those flurry of commits in the past few days, but haven't really looked at the whole thing ^^)
15:16:44 * jelle wonders if the arch container image is reproducible
15:16:48 <h01ger> rclobus: SOURCE_DATE_EPOCH=10000000 mmdebstrap sid > sid.tar
15:16:49 <h01ger> thats it
15:17:34 <rclobus> Where does mmdebstrap get its packages from that timestamp? The snapshot.notset.fr server is not available.
15:17:48 <h01ger> https://salsa.debian.org/qa/jenkins.debian.net/-/blob/master/bin/reproducible_debstrap.sh
15:17:56 <h01ger> the relevant part is lines 80-100
15:18:31 <h01ger> rclobus: it doesnt. i'm not claiming to be able to rebuild today what was build two months ago. yet!
15:18:59 <rclobus> h01ger: Ah, that's exactly the issue I also have with the live-build images
15:19:44 <h01ger> rclobus: its still a major achievement. even though it was mostly documenting / showcasing existing work.
15:20:13 <rclobus> Sure. you have a time window of 6 hours, and then the Debian archive gets a new sync.
15:20:38 <h01ger> rclobus: those jobs run between 1-3min. (creating the image twice)
15:21:00 <h01ger> next topic? (these are ment to be short time slots :)
15:21:21 <rclobus> Ok. (That would be my time slot anyway)
15:21:36 <h01ger> #topic Debian: live-build (rclobus)
15:21:49 <rclobus> As usual, I've prepared my monthly report
15:21:55 <rclobus> #info https://lists.debian.org/debian-live/2022/08/msg00028.html
15:22:01 <h01ger> 👍
15:22:06 <rclobus> Reproducible: no change
15:22:12 <rclobus> Testing: ongoing.
15:22:30 <rclobus> I've switched from snapshot builds to building against deb.debian.org
15:22:57 <rclobus> It can show reproducibility, but it's not long-term reproducible, as seen with mmdebstrap too.
15:23:25 <rclobus> The time involved is much longer per build, so there is more risk to hit the 6 hours window.
15:23:56 <mapreri> I reckon this project too is kind of stalled due to snapshot snafu?
15:24:08 <rclobus> Sort of...
15:24:24 <h01ger> we could adjust the scheduling times to less likely hit the moments where the archive changes
15:24:47 <rclobus> I made a work-around, it still shows that the images can be rebuilt, but that has to be in the same 6 hour slot, before the archive is updated.
15:25:26 <rclobus> Jenkins is doing 3 builds if needed. That is sufficient. (Typically it only needs 2)
15:25:35 <h01ger> ok, cool then
15:25:36 <mapreri> For reference of those missing it, one thing that would/could help moving along the snapshot thing would be completing the proposal at https://salsa.debian.org/freexian-team/project-funding/-/merge_requests/14 (both me and h01ger failed over several months to sit down with Frederic to complete it)
15:25:55 <h01ger> mapreri: thanks!
15:26:12 <h01ger> anything else on debian live images?
15:26:28 <rclobus> That's it. Thanks.
15:26:59 <h01ger> as nobody else seems to have comments on questions...
15:27:05 <h01ger> it seems obfusk and _hc are not here, so we are skipping the F-Droid topic. If you are here, please indicate this, so we can come back to this topic later!
15:27:15 <h01ger> #topic openSUSE
15:27:20 <h01ger> bmwiedemann: ^
15:27:56 <bmwiedemann> I spent some time this month to analyze and fix several year-2038 issues found with my tests. Found that systemd messed with my tests for the last months, but resetting the RTC when it was >15y after build
15:28:29 <bmwiedemann> normal monthly report will soon come.
15:29:04 <h01ger> y2038 reproducibility issues or y2038 issues?
15:29:07 <bmwiedemann> There are also plans to use flatpak more in future products and I found that they are unreproducible so far, so wonder if others have experience there.
15:29:16 <bmwiedemann> the latter
15:29:36 <bmwiedemann> if you cannot build it anymore, it is not reproducible ;-)
15:29:44 <jelle> I was thinking about looking into the reproducibility of flatpaks
15:29:51 <h01ger> bmwiedemann: haha, yes
15:30:36 <h01ger> Mathias Clasen wrote a short text about [reproducing flatpacks from source](https://blogs.gnome.org/mclasen/2018/07/07/flatpak-making-contribution-easy/)
15:30:37 <bmwiedemann> flatpaks use ostree
15:31:16 <h01ger> that was a quote from _blog/posts/168.md from our website.git
15:31:27 <jelle> wondering about diffoscope support now as wel
15:31:29 <jelle> *well
15:31:37 <bmwiedemann> will check it out. I hope it is not just about rebuildability
15:31:43 <h01ger> jelle: for flatpacks?
15:31:46 <jelle> h01ger: yes
15:32:02 <h01ger> well, if diffoscope doesnt support them yet, file an issue and attach two flatpacks :)
15:32:35 <bmwiedemann> That's it from my side
15:32:45 <lamby> :)
15:33:11 <h01ger> it seems aparcar ist not here, so we are skipping the OpenWrt topic. If you are here, please indicate this, so we can come back to this topic later!
15:33:33 <h01ger> so, it seems we're done with our short topics...
15:33:43 <h01ger> #topic r-b summit 2022
15:33:48 <h01ger> mapreri: ^
15:35:03 <mapreri> So, up to this day I've got 21 registrations, and a couple that showed interest but didn't actually formally registered.  I would say that we'll be looking at fixing the venue soon, as well as sending another email to those attendees providing some more details.  I would hope to be able to send said email by end of the next week, but we shall see...
15:35:37 * h01ger is quite happy about so many people showing interest
15:36:03 <h01ger> mapreri: is the date fixed yet?
15:36:31 <mapreri> Also, we haven't yet confirmed any sponsor (nor corporate registration), which would be… quite bad.  One is pretty much sure, but well, not enough!  So if you have knob to turn and pull, that would be great!
15:37:01 <mapreri> h01ger: 1-3 nov is quite very fixed, though of course until we reserve the room it's only 90+% :3
15:37:15 * h01ger nods, thanks
15:38:14 <h01ger> other comments/questions?
15:38:16 <mapreri> open for questions from potential attendees here! :P  Also, if you haven't registered because you are not quite sure of your availability, it's still better to send an email, so perhaps we could see if there will still be slots later on.  I assume with this number we will reserve space fit for ~30 total people.
15:38:29 <mapreri> that's an _assamption_ at this time.
15:38:32 <mapreri> .
15:40:18 <mapreri> assumption*
15:40:58 <h01ger> ok, next & last topic then :)
15:41:07 <h01ger> #topic AOB - any other business
15:41:07 <bmwiedemann> Should I ask SUSE, if they want to sponsor?
15:41:13 <h01ger> bmwiedemann: yes, please!
15:41:50 <h01ger> any other business?
15:44:50 <mapreri> well
15:45:07 <h01ger> well well?
15:45:09 <lamby> None here. :)
15:45:16 <mapreri> if anybody feels doing a bit of web work, last month I noticed that https://reproducible-builds.org/style/visuals/ got broken images somehow
15:45:21 <mapreri> not sure when that happened or how
15:45:31 <mapreri> if anybody wants to have a look when one feels bored…
15:45:47 <h01ger> right. i also noticed we dont have a page describing our logo.
15:45:52 <mapreri> figured I'd just dump this "bug report" on IRC, what better place!?
15:46:12 <lamby> haha
15:46:14 <h01ger> /o\ :)
15:46:39 <h01ger> #info https://reproducible-builds.org/style/visuals/ has broken images and is looking for an MR fixing them
15:46:51 <h01ger> any other business?
15:47:16 <rclobus> No.
15:47:58 <h01ger> :)
15:48:02 <h01ger> seems so indeed.
15:48:29 <h01ger> thank you all for attending and hoping to see you again on Tuesday, 27th of september at 15 utc!
15:48:34 <h01ger> o/
15:48:47 <rclobus> h01ger: Thanks for hosting the meeting
15:49:02 <mapreri> o/
15:49:21 <lamby> Thanks :)
15:50:02 <h01ger> #endmeeting