From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp0 ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms11 with LMTPS id QM+OG1UL2V7SEQAA0tVLHw (envelope-from ) for ; Thu, 04 Jun 2020 14:55:17 +0000 Received: from aspmx1.migadu.com ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp0 with LMTPS id YPBvF1UL2V72fwAA1q6Kng (envelope-from ) for ; Thu, 04 Jun 2020 14:55:17 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id D62A894014C for ; Thu, 4 Jun 2020 14:55:16 +0000 (UTC) Received: from localhost ([::1]:38108 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jgrH1-0004r3-Mg for larch@yhetil.org; Thu, 04 Jun 2020 10:55:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:41262) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jgrGt-0004qu-AC for guix-devel@gnu.org; Thu, 04 Jun 2020 10:55:07 -0400 Received: from cascadia.aikidev.net ([173.255.214.101]:37588) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jgrGs-0004Fx-Ax for guix-devel@gnu.org; Thu, 04 Jun 2020 10:55:07 -0400 Received: from localhost (unknown [IPv6:2600:3c01:e000:21:21:21:0:100e]) (Authenticated sender: vagrant@aikidev.net) by cascadia.aikidev.net (Postfix) with ESMTPSA id EBA751AA50; Thu, 4 Jun 2020 07:55:03 -0700 (PDT) From: Vagrant Cascadian To: Christopher Baines , guix-devel@gnu.org Subject: Re: Build reproducibility metrics In-Reply-To: <87lfl351gk.fsf@cbaines.net> References: <87lfl351gk.fsf@cbaines.net> Date: Thu, 04 Jun 2020 07:54:37 -0700 Message-ID: <877dwmlw42.fsf@ponder> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Received-SPF: none client-ip=173.255.214.101; envelope-from=vagrant@reproducible-builds.org; helo=cascadia.aikidev.net X-detected-operating-system: by eggs.gnu.org: First seen = 2020/06/04 10:55:04 X-ACL-Warn: Detected OS = Linux 3.11 and newer X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, URIBL_BLOCKED=0.001 autolearn=_AUTOLEARN X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: rb-general@lists.reproducible-builds.org Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: "Guix-devel" X-Scanner: scn0 Authentication-Results: aspmx1.migadu.com; dkim=none; dmarc=none; spf=pass (aspmx1.migadu.com: domain of guix-devel-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-devel-bounces@gnu.org X-Spam-Score: -2.61 X-TUID: a0KvmwnlsnBx --=-=-= Content-Type: text/plain On 2020-06-03, Christopher Baines wrote: > Combining that with the substitute server operated by Tobias, which has > a pretty awesome substitute availability of over 90% for recent > revisions, not only is there data from 4 different substitute servers to > use in the comparison, but the proportion of packages where there isn't > sufficient data is pretty low, below 10%. > > I'm currently using the data.guix-patches.cbaines.net instance of the > Guix Data Service, you can see the package substitute availability for > the latest revision using this URL [1], and the package reproducibility > at this URL [2]. > > 1: https://data.guix-patches.cbaines.net/repository/2/branch/master/latest-processed-revision/package-substitute-availability > 2: https://data.guix-patches.cbaines.net/repository/2/branch/master/latest-processed-revision/package-reproducibility > > Some caution is needed when interpreting this data. It's most probably > less up to date than what you'd get through running the guix weather or > guix challenge commands, as it takes the Guix Data Service time to query > the data, that querying process isn't very reliable at the moment > either. Additionally, the "matching" percentage could easily go down if > that output is built with a different hash in the future. > > While the number itself maybe isn't the most useful thing, I like that > clicking through to the "Not matching" outputs will show a list of > outputs which didn't build reproducibly, which is something that could > help identify reproducibility issues to investigate and fix. > > I think things are coming together on the substitute server side. The > goal I have in mind for this is for users of Guix to be able to have > greater trust in the substitutes they use, through trusting substitutes > only if it's been built reproducibly on multiple substitute servers. It > would be great to see work start soon on how guix as a client to > substitute servers might be enhanced to check for reproducibility when > fetching substitutes. Really glad to see great progress on this! I've CC'ed the reproducible builds list, as others might be interested to see too! original post: https://lists.gnu.org/archive/html/guix-devel/2020-06/msg00034.html live well, vagrant --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCXtkLLgAKCRDcUY/If5cW qtjIAP0XuT03xXU6GH2buqt39zU2Rw67hM3hoSvbA/Vge3O3WQD+Pcz+Ii6uRmqX 4qqCdMafV0Y4D9zWlA5umbCr8CYa7w8= =CMIL -----END PGP SIGNATURE----- --=-=-=--