Re: Reproducible Builds Status Summary for Guix

["Ludovic Courtès" <ludo@gnu.org>]

Hi!

Vagrant Cascadian <vagrant@reproducible-builds.org> skribis:

> I've been working on Reproducible Builds in guix a fair amount this
> month.
>
> data.guix.gnu.org has proven invaluable for this work, big thanks for
> that!
>
>   https://data.guix.gnu.org/repository/1/branch/master/latest-processed-revision/package-reproducibility

Neat!

> A few times I ran into disk space issues, due to:
>
>   guix challenge with diffoscope fails to clean up temporary directory
>   https://issues.guix.gnu.org/55809

Should be fixed now.  :-)

> Some rough summaries about the types of issues:
>
>   * ecl-* packages account for nearly half of the issues (~500 out of
>     ~1000 packages)

This seems to be a problem with generated identifiers at first sight;
would be worth taking upstream.  Any Common Lisper here?  :-)

>   * ~850 packages categorized (ecl-* accounting for most of them)
>
>   * 19 packages embed kernel version
>
>   * 63 packages embed timestamps
>
>   * 52 packages embed dates (harder to reproduce that full timestamps)
>
>   * 5 timestamps in python .pyc files
>
>   * 12 timestamps in .jar files
>
>   * 66 ordering issues
>
>   * 3 ordering issues in .pyc files
>
>   * 9 ordering in .jar files
>
>   * 16 ordering in guile .go files
>
>   * ~160 largely unidentified and inscrutible issues
>
> That's unfortunately a lot of "unidentified" issues, but I figured I'd
> at least mark the ones I looked at.

Yes, that’s already an insightful breakdown.

> There is a rough proposal for using a multi-project "notes" format that
> debian uses:
>
>   https://salsa.debian.org/reproducible-builds/reproducible-notes/-/tree/master
>   https://salsa.debian.org/reproducible-builds/reproducible-notes/-/blob/multi-project-syntax/ideas_on_sharing_notes_between_distros
>
> ... back in 2016, and touched on at later Reproducible Builds summits,
> but not really adopted as far as I know. But I know some of the issues
> are essentially the same across distros; yet some are surprisingly
> different even with the same source code!

I was very optimistic about using this database cross-distro back at the
first R-B Summit!  I still look at it occasionally when an issue pops
up, but it’s not become the collaborative platform we were hoping for.
It’s never too late though!

(Debian is in sense stricter in that some things can be an issue there
(like store build file names) and not here, because the Guix build
environment is controlled and “canonicalized”.  So not all the issues in
there are relevant to us I guess.)

Thanks for the update!

Ludo’.