The officially official Devuan Forum!

You are not logged in.

#1 2023-04-30 16:04:55

jas
Member
Registered: 2023-04-30
Posts: 1  

Interest in reproducible builds of Devuan? Devuan is 46% reproducibe!

Hi

I have a project that rebuilds all Devuan packages (i.e., those added/modified compared to Debian), and generate statistics here:

https://gitlab.com/debdistutils/reproduce/devuan

Is there interest in reproducible builds of the Devuan-specific packages like this?  Help and feedback is most welcome!  There are many things that can be improved, but at least it manages to build some packages reproducible which is a first step.

What would really help are if Devuan published *.buildinfo files for their builds, has this been considered?

/SImon

Offline

#2 2023-07-20 15:59:25

Morty
Member
From: Germany
Registered: 2021-02-24
Posts: 11  

Re: Interest in reproducible builds of Devuan? Devuan is 46% reproducibe!

I would love a fully reproducible Devuan. Some people dont consider installing devuan because dont know or trust the devuan packagers/devs. Being fully reproducible would help with this issue.

Offline

#3 2023-07-20 16:27:13

golinux
Administrator
Registered: 2016-11-25
Posts: 3,305  

Re: Interest in reproducible builds of Devuan? Devuan is 46% reproducibe!

@jas . . . Packaging is way above my paygrade but perhaps this would help sort your confusion about how Devuan packages are built?

https://git.devuan.org/devuan/documenta … aintainers
https://jenkins.devuan.dev/job/devuan-package-builder/

Online

#4 2023-07-21 06:00:33

vortex
Member
Registered: 2020-11-12
Posts: 14  

Re: Interest in reproducible builds of Devuan? Devuan is 46% reproducibe!

Hi jas,

Thanks for posting. This is interesting work!

Further to golinux's post, there is

https://git.devuan.org/devuan/documenta … nvironment

which claims

The jenkins build pipeline uses git-buildpackage, pbuilder and cowbuilder. This ensures more flexible and reproducible builds in a cleaner environment than other build approaches.

Given the results of your work, likely there is something in the jenkins build pipeline that is losing reproducibility (or the claim is mistaken/out-of-date)?

What would really help are if Devuan published *.buildinfo files for their builds, has this been considered?

Best approach for this request would be to raise issue on Devuan gitea instance. Maybe initially on

https://git.devuan.org/devuan/documentation

to question/correct the statement quoted above?

Offline

Board footer