Builds are not reproducible #3
Comments
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
It looks like the I added a commit that implement this in my branch in the vanagon project. I updated the test branch in the openvox-agent project to point to this commit, and generated packages for various versions of Debian amd64. You can try to generate these packages with these commands: If you want to use Vagrant: # To generate packages and see their md5sum:
# vagrant up --provision
Vagrant.configure("2") do |config|
config.vm.box = "debian/bookworm64"
config.vm.provider "virtualbox" do |vb|
vb.memory = "2048"
end
config.vm.provision "shell", inline: <<-SHELL
apt-get update
apt-get install -y git ruby-bundler build-essential ruby-dev libyaml-dev docker.io
cd /tmp
git clone https://github.com/OpenVoxProject/openvox-agent # my clone does not have the required tags
cd openvox-agent
git remote add smortex https://github.com/smortex/openvox-agent
git fetch smortex
git checkout 287c1a3845347650c813a6346a82adeee53c1581 # You must be on that exact commit!
bundle config path /tmp/do-not-mess-up-with-system
bundle install
bundle exec rake 'vox:build[openvox-agent,debian-12-amd64]' # Adjust here for a different target
md5sum /tmp/openvox-agent/output/deb/debian12/openvox8/*.deb
SHELL
endHere are the checksum of the files I built on my test machines: If you have different cheksum, I uploaded my packages here for inspection: Please report success / failure with a thumps-up 👍 or thumbs-down 👎 emoji. Thank you 😍 ! |
|
/cc @jcharaoui |
|
I just wanted to make sure that people working on reproducibility know about the Reproducible Builds project and, more specifically, Diffoscope. https://try.diffoscope.org/ makes using diffoscope really easy for smallish packages, and can dig into really gory detail about where differences come about. |
This is a meta-issue to track work on improving openvox-agent packages build reproducibility.
Rationale
Puppetlabs packages relied on internal resources to build packages, so it was not possible for the community to fully audit the build process.
Now that we have our own tooling for building packages and anybody can check how packages are built, we can go further and make it possible to check that packages which have been built with these tools have not been altered by ensuring builds are reproducible.
How to check for reproducibility
Basically you build the package twice and check if the generated artifacts are different.
For examples, for Debian packages:
The generated files in
output/deb/debian12/openvox8-firstandoutput/deb/debian12/openvox8-secondcan be further checked, e.g.:Scope
For now, I (@smortex) work on the Debian 12 packages only. Issues are likely to be similar on different targets but you are encouraged to test your platform and help with reproducibility issues resolution.
Current issues
WIP / Related PRs
Make builds reproducible vanagon#2
opt/puppetlabs/puppet/lib/ruby/vendor_gems/cache/puppet-resource_api-1.9.0.gem(current date affect build)usr/share/doc/openvox-agent/changelog.Debian.gz(current date used in the generated changelog entry)Files changed by(it did not failed the second day I worked on this. I probably messed something on my side)dh_strip_nondeterminismin a non reproducible wayopt/puppetlabs/puppet/lib/ruby/3.2.0/rdoc/generator/template/darkfish/images/macFFBgHack.png(timestamp in image)opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/concurrent-ruby-1.2.3/lib/concurrent-ruby/concurrent/concurrent_ruby.jar(needs further inspection)opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/highline-3.1.0/site/images/logo.png(a few bytes different in headers, more inspection needed)opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/locale-2.1.4/lib/locale/data/languages.tab.gz(gzip timestamp in header)opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/locale-2.1.4/lib/locale/data/regions.tab.gz(gzip timestamp in header)opt/puppetlabs/puppet/share/man/man8/facter.8.gz(gzip timestamp in header)opt/puppetlabs/puppet/share/man/man8/puppet*.8.gz(gzip timestamp in header)The text was updated successfully, but these errors were encountered: