The officially official Devuan Forum!

jas

Member

Registered: 2023-04-30

Posts: 1  

Interest in reproducible builds of Devuan? Devuan is 46% reproducibe!

Hi

I have a project that rebuilds all Devuan packages (i.e., those added/modified compared to Debian), and generate statistics here:

https://gitlab.com/debdistutils/reproduce/devuan

Is there interest in reproducible builds of the Devuan-specific packages like this?  Help and feedback is most welcome!  There are many things that can be improved, but at least it manages to build some packages reproducible which is a first step.

What would really help are if Devuan published *.buildinfo files for their builds, has this been considered?

/SImon

Morty

Member

From: Germany

Registered: 2021-02-24

Posts: 11  

Re: Interest in reproducible builds of Devuan? Devuan is 46% reproducibe!

I would love a fully reproducible Devuan. Some people dont consider installing devuan because dont know or trust the devuan packagers/devs. Being fully reproducible would help with this issue.

golinux

Administrator

Registered: 2016-11-25

Posts: 3,144  

Re: Interest in reproducible builds of Devuan? Devuan is 46% reproducibe!

@jas . . . Packaging is way above my paygrade but perhaps this would help sort your confusion about how Devuan packages are built?

https://git.devuan.org/devuan/documenta … aintainers
https://jenkins.devuan.dev/job/devuan-package-builder/

---

Get answers - Help Devuan - Report a bug - Search packages

vortex

Member

Registered: 2020-11-12

Posts: 12  

Re: Interest in reproducible builds of Devuan? Devuan is 46% reproducibe!

Hi jas,

Thanks for posting. This is interesting work!

Further to golinux's post, there is

https://git.devuan.org/devuan/documenta … nvironment

which claims

The jenkins build pipeline uses git-buildpackage, pbuilder and cowbuilder. This ensures more flexible and reproducible builds in a cleaner environment than other build approaches.

Given the results of your work, likely there is something in the jenkins build pipeline that is losing reproducibility (or the claim is mistaken/out-of-date)?

What would really help are if Devuan published *.buildinfo files for their builds, has this been considered?

Best approach for this request would be to raise issue on Devuan gitea instance. Maybe initially on

https://git.devuan.org/devuan/documentation

to question/correct the statement quoted above?