Bug#847805: reprotest: document/support simple reproducibility test with sbuild
On 2016-12-11, Sean Whitton wrote: > On Sun, Dec 11, 2016 at 03:12:57PM -0700, Sean Whitton wrote: >> I have sbuild properly set up on my machine, and I want to use it to >> test package reproducibility. Something like this, where PWD is an >> unpacked source package: >> >> 1) sbuild >> 2) record .deb checksums from .changes file >> 3) sbuild >> 4) compare .deb checksums in new .changes file >> 5) run diffoscope if the checksums differ > > Thanks to #debian-reproducible, this is mostly what I wanted: > > reprotest auto . -- schroot unstable-amd64-sbuild > > This doesn't actually invoke sbuild, but it does perform the builds > inside the schroot I already have set up, and compare the results. > > This is useful, but it would also be good if reprotest could invoke > sbuild(1) itself. That is because sbuild has lots of useful options. > > For example, suppose that foo depends on dh_bar, and I am hacking on > dh_bar in the hope of making foo reproducible. Then I want to build foo > against my local version of dh_bar. With sbuild, I can do this using > --extra-package and --add-depends. reprotest with a pure schroot > backend can't do that kind of thing, so far as I can tell. A while back I did work on a simple wrapper for sbuild that calls reprotest as part of a --finished-build-commands hook: https://salsa.debian.org/reproducible-builds/sbuild-unshare-reprotest It is definitely quite rough around the edges and there are some caveats that limit the functionality, but can do some of what you were looking for. live well, vagrant signature.asc Description: PGP signature
Bug#847805: reprotest: document/support simple reproducibility test with sbuild
Hello Johannes, On Mon, Dec 12, 2016 at 05:38:53PM +0100, Johannes Schauer wrote: > Quoting Sean Whitton (2016-12-12 16:44:54) > > Thank you for your replies. sbuild is definitely sufficient, it's just a > > bit > > of a drag -- you have to rename the .changes to save the checksums, and then > > run sbuild a second time, and compare. I was going to write a shell script > > to do this, but then someone in #debian-devel told me to look at reprotest. > > instead of renaming your .changes, why not place your .changes into two > different directories? Either by changing the working directory of sbuild or > by > setting the BUILD_DIR configuration variable. Thanks for the hint! -- Sean Whitton signature.asc Description: PGP signature
Bug#847805: reprotest: document/support simple reproducibility test with sbuild
Hi, Quoting Sean Whitton (2016-12-12 16:44:54) > Thank you for your replies. sbuild is definitely sufficient, it's just a bit > of a drag -- you have to rename the .changes to save the checksums, and then > run sbuild a second time, and compare. I was going to write a shell script > to do this, but then someone in #debian-devel told me to look at reprotest. instead of renaming your .changes, why not place your .changes into two different directories? Either by changing the working directory of sbuild or by setting the BUILD_DIR configuration variable. Thanks! cheers, josch signature.asc Description: signature
Bug#847805: reprotest: document/support simple reproducibility test with sbuild
Hello Johannes, Mattia, On Mon, Dec 12, 2016 at 10:05:29AM +0100, Johannes Schauer wrote: > In the latter case, I'm open to patches against sbuild which could easily > carry > such an sbuild wrapper to automatically test reproducibility with sbuild on > Debian (and derivatives). > > In either case, with my sbuild maintainer hat on, please file wishlist bugs > against sbuild if its interface is not sufficient to run reproducibility tests > with it. On Mon, Dec 12, 2016 at 12:05:30PM +0100, Mattia Rizzolo wrote: > Ditto for pbuilder. Thank you for your replies. sbuild is definitely sufficient, it's just a bit of a drag -- you have to rename the .changes to save the checksums, and then run sbuild a second time, and compare. I was going to write a shell script to do this, but then someone in #debian-devel told me to look at reprotest. -- Sean Whitton signature.asc Description: PGP signature
Bug#847805: reprotest: document/support simple reproducibility test with sbuild
On Mon, Dec 12, 2016 at 10:05:29AM +0100, Johannes Schauer wrote: > In the latter case, I'm open to patches against sbuild which could easily > carry > such an sbuild wrapper to automatically test reproducibility with sbuild on > Debian (and derivatives). > > In either case, with my sbuild maintainer hat on, please file wishlist bugs > against sbuild if its interface is not sufficient to run reproducibility tests > with it. Ditto for pbuilder. -- regards, Mattia Rizzolo GPG Key: 66AE 2B4A FCCF 3F52 DA18 4D18 4B04 3FCD B944 4540 .''`. more about me: https://mapreri.org : :' : Launchpad user: https://launchpad.net/~mapreri `. `'` Debian QA page: https://qa.debian.org/developer.php?login=mattia `- signature.asc Description: PGP signature
Bug#847805: reprotest: document/support simple reproducibility test with sbuild
Hi Sean, Quoting Sean Whitton (2016-12-12 00:44:05) > On Sun, Dec 11, 2016 at 03:12:57PM -0700, Sean Whitton wrote: > > I have sbuild properly set up on my machine, and I want to use it to > > test package reproducibility. Something like this, where PWD is an > > unpacked source package: > > > > 1) sbuild > > 2) record .deb checksums from .changes file > > 3) sbuild > > 4) compare .deb checksums in new .changes file > > 5) run diffoscope if the checksums differ > > Thanks to #debian-reproducible, this is mostly what I wanted: > > reprotest auto . -- schroot unstable-amd64-sbuild > > This doesn't actually invoke sbuild, but it does perform the builds > inside the schroot I already have set up, and compare the results. > > This is useful, but it would also be good if reprotest could invoke > sbuild(1) itself. That is because sbuild has lots of useful options. > > For example, suppose that foo depends on dh_bar, and I am hacking on > dh_bar in the hope of making foo reproducible. Then I want to build foo > against my local version of dh_bar. With sbuild, I can do this using > --extra-package and --add-depends. reprotest with a pure schroot backend > can't do that kind of thing, so far as I can tell. from what I understood, reprotest is supposed to be distribution agnostic. This is also why they forked autopkgtest which supposedly makes many Debian-specific assumptions. I second your desire to have a tool that works well for development in Debian (and its derivatives) - for example by using sbuild or pbuilder instead. It is up to the reprotest maintainers whether such feature should be added to reprotest or whether we really need "yet another shell script". In the latter case, I'm open to patches against sbuild which could easily carry such an sbuild wrapper to automatically test reproducibility with sbuild on Debian (and derivatives). In either case, with my sbuild maintainer hat on, please file wishlist bugs against sbuild if its interface is not sufficient to run reproducibility tests with it. Thanks! cheers, josch signature.asc Description: signature
Bug#847805: reprotest: document/support simple reproducibility test with sbuild
Hello, On Sun, Dec 11, 2016 at 03:12:57PM -0700, Sean Whitton wrote: > I have sbuild properly set up on my machine, and I want to use it to > test package reproducibility. Something like this, where PWD is an > unpacked source package: > > 1) sbuild > 2) record .deb checksums from .changes file > 3) sbuild > 4) compare .deb checksums in new .changes file > 5) run diffoscope if the checksums differ Thanks to #debian-reproducible, this is mostly what I wanted: reprotest auto . -- schroot unstable-amd64-sbuild This doesn't actually invoke sbuild, but it does perform the builds inside the schroot I already have set up, and compare the results. This is useful, but it would also be good if reprotest could invoke sbuild(1) itself. That is because sbuild has lots of useful options. For example, suppose that foo depends on dh_bar, and I am hacking on dh_bar in the hope of making foo reproducible. Then I want to build foo against my local version of dh_bar. With sbuild, I can do this using --extra-package and --add-depends. reprotest with a pure schroot backend can't do that kind of thing, so far as I can tell. With regard to documentation, for users like me who are used to just invoking `sbuild`, I'd like to suggesting add this third example to the top of /usr/share/doc/reprotest/README.md.gz: # Where PWD is an unpacked source package, construct a .dsc and # build it in a schroot. This is equivalent to invoking `sbuild` # twice, and comparing the results reprotest auto . -- schroot unstable-amd64-sbuild -- Sean Whitton signature.asc Description: PGP signature
Bug#847805: reprotest: document/support simple reproducibility test with sbuild
Package: reprotest Version: 0.4 Severity: wishlist Dear maintainers, Thanks for the tool! I have sbuild properly set up on my machine, and I want to use it to test package reproducibility. Something like this, where PWD is an unpacked source package: 1) sbuild 2) record .deb checksums from .changes file 3) sbuild 4) compare .deb checksums in new .changes file 5) run diffoscope if the checksums differ Rather than writing yet another shell script, I think that reprotest should be able to do this for me, but I can't figure it out from the --help output. Is this something that reprotest is meant to help me with? If so, could it be documented somewhere? Thanks. -- System Information: Debian Release: stretch/sid APT prefers testing APT policy: (900, 'testing') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.7.0-1-amd64 (SMP w/4 CPU cores) Locale: LANG=en_GB.utf8, LC_CTYPE=en_GB.utf8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages reprotest depends on: ii apt-utils 1.4~beta1 ii diffoscope 63 ii libdpkg-perl 1.18.10 ii procps 2:3.3.12-3 ii python3-debian 0.1.29 ii python3-pkg-resources 28.7.1-1 pn python3:any Versions of packages reprotest recommends: ii disorderfs 0.5.1-1 ii locales-all 2.24-7 Versions of packages reprotest suggests: ii autodep8 0.8 pn qemu-system ii qemu-utils 1:2.7+dfsg-3+b1 ii schroot 1.6.10-2+b1 -- no debconf information -- Sean Whitton signature.asc Description: PGP signature
