Debian Bug report logs - #847805
reprotest: document/support simple reproducibility test with sbuild

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Sean Whitton <spwhitton@spwhitton.name>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: reprotest: document/support simple reproducibility test with sbuild

Date: Sun, 11 Dec 2016 15:12:57 -0700

[Message part 1 (text/plain, inline)]

Package: reprotest
Version: 0.4
Severity: wishlist

Dear maintainers,

Thanks for the tool!

I have sbuild properly set up on my machine, and I want to use it to
test package reproducibility.  Something like this, where PWD is an
unpacked source package:

1) sbuild
2) record .deb checksums from .changes file
3) sbuild
4) compare .deb checksums in new .changes file
5) run diffoscope if the checksums differ

Rather than writing yet another shell script, I think that reprotest
should be able to do this for me, but I can't figure it out from the
--help output.

Is this something that reprotest is meant to help me with?  If so, could
it be documented somewhere?

Thanks.

-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (900, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.7.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.utf8, LC_CTYPE=en_GB.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages reprotest depends on:
ii  apt-utils              1.4~beta1
ii  diffoscope             63
ii  libdpkg-perl           1.18.10
ii  procps                 2:3.3.12-3
ii  python3-debian         0.1.29
ii  python3-pkg-resources  28.7.1-1
pn  python3:any            <none>

Versions of packages reprotest recommends:
ii  disorderfs   0.5.1-1
ii  locales-all  2.24-7

Versions of packages reprotest suggests:
ii  autodep8     0.8
pn  qemu-system  <none>
ii  qemu-utils   1:2.7+dfsg-3+b1
ii  schroot      1.6.10-2+b1

-- no debconf information

-- 
Sean Whitton

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 847805@bugs.debian.org (full text, mbox, reply):

From: Sean Whitton <spwhitton@spwhitton.name>

To: 847805@bugs.debian.org

Subject: Re: reprotest: document/support simple reproducibility test with sbuild

Date: Sun, 11 Dec 2016 16:44:05 -0700

[Message part 1 (text/plain, inline)]

Hello,

On Sun, Dec 11, 2016 at 03:12:57PM -0700, Sean Whitton wrote:
> I have sbuild properly set up on my machine, and I want to use it to
> test package reproducibility.  Something like this, where PWD is an
> unpacked source package:
> 
> 1) sbuild
> 2) record .deb checksums from .changes file
> 3) sbuild
> 4) compare .deb checksums in new .changes file
> 5) run diffoscope if the checksums differ

Thanks to #debian-reproducible, this is mostly what I wanted:

    reprotest auto . -- schroot unstable-amd64-sbuild

This doesn't actually invoke sbuild, but it does perform the builds
inside the schroot I already have set up, and compare the results.

This is useful, but it would also be good if reprotest could invoke
sbuild(1) itself.  That is because sbuild has lots of useful options.

For example, suppose that foo depends on dh_bar, and I am hacking on
dh_bar in the hope of making foo reproducible.  Then I want to build foo
against my local version of dh_bar.  With sbuild, I can do this using
--extra-package and --add-depends.  reprotest with a pure schroot
backend can't do that kind of thing, so far as I can tell.

With regard to documentation, for users like me who are used to just
invoking `sbuild`, I'd like to suggesting add this third example to the
top of /usr/share/doc/reprotest/README.md.gz:

    # Where PWD is an unpacked source package, construct a .dsc and
    # build it in a schroot.  This is equivalent to invoking `sbuild`
    # twice, and comparing the results
    reprotest auto . -- schroot unstable-amd64-sbuild

-- 
Sean Whitton

[signature.asc (application/pgp-signature, inline)]

Message #15 received at 847805@bugs.debian.org (full text, mbox, reply):

From: Johannes Schauer <josch@debian.org>

To: "Sean Whitton" <spwhitton@spwhitton.name>, 847805@bugs.debian.org

Subject: Re: Bug#847805: reprotest: document/support simple reproducibility test with sbuild

Date: Mon, 12 Dec 2016 10:05:29 +0100

[Message part 1 (text/plain, inline)]

Hi Sean,

Quoting Sean Whitton (2016-12-12 00:44:05)
> On Sun, Dec 11, 2016 at 03:12:57PM -0700, Sean Whitton wrote:
> > I have sbuild properly set up on my machine, and I want to use it to
> > test package reproducibility.  Something like this, where PWD is an
> > unpacked source package:
> > 
> > 1) sbuild
> > 2) record .deb checksums from .changes file
> > 3) sbuild
> > 4) compare .deb checksums in new .changes file
> > 5) run diffoscope if the checksums differ
> 
> Thanks to #debian-reproducible, this is mostly what I wanted:
> 
>     reprotest auto . -- schroot unstable-amd64-sbuild
> 
> This doesn't actually invoke sbuild, but it does perform the builds
> inside the schroot I already have set up, and compare the results.
> 
> This is useful, but it would also be good if reprotest could invoke
> sbuild(1) itself.  That is because sbuild has lots of useful options.
> 
> For example, suppose that foo depends on dh_bar, and I am hacking on
> dh_bar in the hope of making foo reproducible.  Then I want to build foo
> against my local version of dh_bar.  With sbuild, I can do this using
> --extra-package and --add-depends.  reprotest with a pure schroot backend
> can't do that kind of thing, so far as I can tell.

from what I understood, reprotest is supposed to be distribution agnostic. This
is also why they forked autopkgtest which supposedly makes many Debian-specific
assumptions.

I second your desire to have a tool that works well for development in Debian
(and its derivatives) - for example by using sbuild or pbuilder instead. It is
up to the reprotest maintainers whether such feature should be added to
reprotest or whether we really need "yet another shell script".

In the latter case, I'm open to patches against sbuild which could easily carry
such an sbuild wrapper to automatically test reproducibility with sbuild on
Debian (and derivatives).

In either case, with my sbuild maintainer hat on, please file wishlist bugs
against sbuild if its interface is not sufficient to run reproducibility tests
with it.

Thanks!

cheers, josch

[signature.asc (application/pgp-signature, inline)]

Message #18 received at 847805@bugs.debian.org (full text, mbox, reply):

From: Mattia Rizzolo <mattia@debian.org>

To: Johannes Schauer <josch@debian.org>, 847805@bugs.debian.org, Sean Whitton <spwhitton@spwhitton.name>

Subject: Re: Bug#847805: reprotest: document/support simple reproducibility test with sbuild

Date: Mon, 12 Dec 2016 12:05:30 +0100

[Message part 1 (text/plain, inline)]

On Mon, Dec 12, 2016 at 10:05:29AM +0100, Johannes Schauer wrote:
> In the latter case, I'm open to patches against sbuild which could easily carry
> such an sbuild wrapper to automatically test reproducibility with sbuild on
> Debian (and derivatives).
> 
> In either case, with my sbuild maintainer hat on, please file wishlist bugs
> against sbuild if its interface is not sufficient to run reproducibility tests
> with it.

Ditto for pbuilder.

-- 
regards,
                        Mattia Rizzolo

GPG Key: 66AE 2B4A FCCF 3F52 DA18  4D18 4B04 3FCD B944 4540      .''`.
more about me:  https://mapreri.org                             : :'  :
Launchpad user: https://launchpad.net/~mapreri                  `. `'`
Debian QA page: https://qa.debian.org/developer.php?login=mattia  `-

[signature.asc (application/pgp-signature, inline)]

Message #23 received at 847805@bugs.debian.org (full text, mbox, reply):

From: Sean Whitton <spwhitton@spwhitton.name>

To: Johannes Schauer <josch@debian.org>, Mattia Rizzolo <mattia@debian.org>

Cc: 847805@bugs.debian.org

Subject: Re: Bug#847805: reprotest: document/support simple reproducibility test with sbuild

Date: Mon, 12 Dec 2016 08:44:54 -0700

[Message part 1 (text/plain, inline)]

Hello Johannes, Mattia,

On Mon, Dec 12, 2016 at 10:05:29AM +0100, Johannes Schauer wrote:
> In the latter case, I'm open to patches against sbuild which could easily carry
> such an sbuild wrapper to automatically test reproducibility with sbuild on
> Debian (and derivatives).
> 
> In either case, with my sbuild maintainer hat on, please file wishlist bugs
> against sbuild if its interface is not sufficient to run reproducibility tests
> with it.

On Mon, Dec 12, 2016 at 12:05:30PM +0100, Mattia Rizzolo wrote:
> Ditto for pbuilder.

Thank you for your replies.  sbuild is definitely sufficient, it's just
a bit of a drag -- you have to rename the .changes to save the
checksums, and then run sbuild a second time, and compare.  I was going
to write a shell script to do this, but then someone in #debian-devel
told me to look at reprotest.

-- 
Sean Whitton

[signature.asc (application/pgp-signature, inline)]

Message #28 received at 847805@bugs.debian.org (full text, mbox, reply):

From: Johannes Schauer <josch@debian.org>

To: "Sean Whitton" <spwhitton@spwhitton.name>, "Mattia Rizzolo" <mattia@debian.org>, 847805@bugs.debian.org

Subject: Re: Bug#847805: reprotest: document/support simple reproducibility test with sbuild

Date: Mon, 12 Dec 2016 17:38:53 +0100

[Message part 1 (text/plain, inline)]

Hi,

Quoting Sean Whitton (2016-12-12 16:44:54)
> Thank you for your replies.  sbuild is definitely sufficient, it's just a bit
> of a drag -- you have to rename the .changes to save the checksums, and then
> run sbuild a second time, and compare.  I was going to write a shell script
> to do this, but then someone in #debian-devel told me to look at reprotest.

instead of renaming your .changes, why not place your .changes into two
different directories? Either by changing the working directory of sbuild or by
setting the BUILD_DIR configuration variable.

Thanks!

cheers, josch

[signature.asc (application/pgp-signature, inline)]

Message #33 received at 847805@bugs.debian.org (full text, mbox, reply):

From: Sean Whitton <spwhitton@spwhitton.name>

To: Johannes Schauer <josch@debian.org>

Cc: Mattia Rizzolo <mattia@debian.org>, 847805@bugs.debian.org

Subject: Re: Bug#847805: reprotest: document/support simple reproducibility test with sbuild

Date: Mon, 12 Dec 2016 10:13:04 -0700

[Message part 1 (text/plain, inline)]

Hello Johannes,

On Mon, Dec 12, 2016 at 05:38:53PM +0100, Johannes Schauer wrote:
> Quoting Sean Whitton (2016-12-12 16:44:54)
> > Thank you for your replies.  sbuild is definitely sufficient, it's just a bit
> > of a drag -- you have to rename the .changes to save the checksums, and then
> > run sbuild a second time, and compare.  I was going to write a shell script
> > to do this, but then someone in #debian-devel told me to look at reprotest.
> 
> instead of renaming your .changes, why not place your .changes into two
> different directories? Either by changing the working directory of sbuild or by
> setting the BUILD_DIR configuration variable.

Thanks for the hint!

-- 
Sean Whitton

[signature.asc (application/pgp-signature, inline)]

Message #38 received at 847805-close@bugs.debian.org (full text, mbox, reply):

From: Alastair McKinstry <mckinstry@debian.org>

To: 847805-close@bugs.debian.org

Subject: Bug#847805: fixed in openmpi 2.0.2~git.20161225-9

Date: Sun, 15 Jan 2017 15:06:14 +0000

Source: openmpi
Source-Version: 2.0.2~git.20161225-9

We believe that the bug you reported is fixed in the latest version of
openmpi, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 847805@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alastair McKinstry <mckinstry@debian.org> (supplier of updated openmpi package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 15 Jan 2017 11:08:14 +0000
Source: openmpi
Binary: openmpi-bin libopenmpi-dev libopenmpi2 openmpi-common openmpi-doc
Architecture: source amd64 all
Version: 2.0.2~git.20161225-9
Distribution: unstable
Urgency: medium
Maintainer: Alastair McKinstry <mckinstry@debian.org>
Changed-By: Alastair McKinstry <mckinstry@debian.org>
Description:
 libopenmpi-dev - high performance message passing library -- header files
 libopenmpi2 - high performance message passing library -- shared library
 openmpi-bin - high performance message passing library -- binaries
 openmpi-common - high performance message passing library -- common files
 openmpi-doc - high performance message passing library -- man pages
Closes: 847805
Changes:
 openmpi (2.0.2~git.20161225-9) unstable; urgency=medium
 .
   * Fix incorrect SONAME version in symlink. Closes: #847805
Checksums-Sha1:
 556fb475f7f45d80f0d48705953a406d12ef84e5 2796 openmpi_2.0.2~git.20161225-9.dsc
 aa6774fac0da396615921ab53f6e1ce0aed79425 60544 openmpi_2.0.2~git.20161225-9.debian.tar.xz
 a18291c3be9ab8c1be8b0144bb339e7384f13b95 27260 libopenmpi-dev-dbgsym_2.0.2~git.20161225-9_amd64.deb
 2dab4f748878b9ba60f8908efcf5d8871086abd4 1059482 libopenmpi-dev_2.0.2~git.20161225-9_amd64.deb
 dada05ec5ce465f81b506431ff77413882c981d8 30542272 libopenmpi2-dbgsym_2.0.2~git.20161225-9_amd64.deb
 26ea572f9985f1d26cefc2d504883c72e31c926a 2312130 libopenmpi2_2.0.2~git.20161225-9_amd64.deb
 577c5d25748f501b9034ee696a2b30fed6529106 209612 openmpi-bin-dbgsym_2.0.2~git.20161225-9_amd64.deb
 2fc8620b648f3b28e1104ba4b0fc00c47f1c5d4b 168810 openmpi-bin_2.0.2~git.20161225-9_amd64.deb
 1e2d3e6c457a020579c67600bd89c99fa0429a4b 148300 openmpi-common_2.0.2~git.20161225-9_all.deb
 e44fcc860062990176d8c095975be64ae0de7a65 754478 openmpi-doc_2.0.2~git.20161225-9_all.deb
 7c01cf5158e9220bbbf75bfea697c3c549570a98 11911 openmpi_2.0.2~git.20161225-9_amd64.buildinfo
Checksums-Sha256:
 f1a6c119300200f434e92d0c9a6437c0b193a80daa2dd30973ad5e94c541e5aa 2796 openmpi_2.0.2~git.20161225-9.dsc
 a94bdc44152dc4b66de1541b17a3c896d48c306b3031a9eaf3fd97d7b4e290e4 60544 openmpi_2.0.2~git.20161225-9.debian.tar.xz
 52fedff517ff9906c418b4196934893c0c5c755a76ff46e7591fcfba08c78261 27260 libopenmpi-dev-dbgsym_2.0.2~git.20161225-9_amd64.deb
 f1513256cb06533fe8ebbf9d37a1a515e4975d994f4efbadb5691e81b9978594 1059482 libopenmpi-dev_2.0.2~git.20161225-9_amd64.deb
 57110a7739e5bd013f264cc27ee73c70ffafa7a82808d1118d91b64affabbd90 30542272 libopenmpi2-dbgsym_2.0.2~git.20161225-9_amd64.deb
 ca30d1dc19e3914352ea224c10e7b0aa4eaf8e5c1d0153d85281f159d1bba9bc 2312130 libopenmpi2_2.0.2~git.20161225-9_amd64.deb
 cfb9b494243749f1f38ed1328f441dd94da5d3e90cb6fc8a4e3435c67124164c 209612 openmpi-bin-dbgsym_2.0.2~git.20161225-9_amd64.deb
 349a3e6986fcc35307f48d552e16c7ae359077d535751dcb06407db4b702b11a 168810 openmpi-bin_2.0.2~git.20161225-9_amd64.deb
 e9f0b71ba0677a6409b7d900fae627b0bdd3c2581f8148c25f25b522a365a41b 148300 openmpi-common_2.0.2~git.20161225-9_all.deb
 db2b102016f7d7c2dd22a0c27f27dd96c1154e28f2b13e7fbadae035b129959d 754478 openmpi-doc_2.0.2~git.20161225-9_all.deb
 25b68351fdf07f80d8e85a4713319834373a21938d4458c2232c2aedd6c99637 11911 openmpi_2.0.2~git.20161225-9_amd64.buildinfo
Files:
 ad21b159e19ed12537fddcd45078d888 2796 net extra openmpi_2.0.2~git.20161225-9.dsc
 7df21fcddf4c213fe55c602c405ef845 60544 net extra openmpi_2.0.2~git.20161225-9.debian.tar.xz
 84eeefaff6637ec899f33430bb868b63 27260 debug extra libopenmpi-dev-dbgsym_2.0.2~git.20161225-9_amd64.deb
 9e10f15629bfa2fe61d9153c2f975e74 1059482 libdevel extra libopenmpi-dev_2.0.2~git.20161225-9_amd64.deb
 687e8280826c1355eb0309924729634e 30542272 debug extra libopenmpi2-dbgsym_2.0.2~git.20161225-9_amd64.deb
 15732e59a42506a452c9a9a643732936 2312130 libs extra libopenmpi2_2.0.2~git.20161225-9_amd64.deb
 4d230ef16318ec2825e8c3c43a55b345 209612 debug extra openmpi-bin-dbgsym_2.0.2~git.20161225-9_amd64.deb
 90e9a61bd4f11b114d019fd97a3afead 168810 net extra openmpi-bin_2.0.2~git.20161225-9_amd64.deb
 d5be053b01fb9ed73b8f43a2f86a2be4 148300 net extra openmpi-common_2.0.2~git.20161225-9_all.deb
 81739f6a95f312fae75048b4d46059e2 754478 doc extra openmpi-doc_2.0.2~git.20161225-9_all.deb
 d6064ad74e5e499aba5f7be492e34b8d 11911 net extra openmpi_2.0.2~git.20161225-9_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEgjg86RZbNHx4cIGiy+a7Tl2a06UFAlh7csEACgkQy+a7Tl2a
06Vh2Q//Utk68t7FWtNKWQlg/mW7jiWl5joa/jkZe33ueXGLfki3sR2nnANacCJF
mg6kM6/3FcFUr+jB7hQbtBcZeO3FAmHS6jLCQKLcbQVUzp0aasD8TdqpEyZW/WZI
6+7sbcJM9wNOJCTt5ExoCaxJQ5Fr8W2sGMY7Fq+sdegPox0hCRIvjqwEnbBSvvmu
xPbPIn+Ad3VYF73r3QGmCpGOWb6gmGNxvtVaLhm+TigXUIUgC+epVvqHjc5Vzvyq
QrUOGEzxBl2dQgT2ULQLwi62wtnWkoERL+o+xhHMTi+QKpLsrGQtHz66o6vKfBTA
1RGgQ9UtAEy5k6w6aEcF6WTSaakasdk+ji7YGAR4x338fuxJHnkmEapJnu2unGwv
ChTFeJaa31CiypEKDP2h0zCtX3gitVQRk7L2e4BL+mW5/Vyf97D/uEUR5nxL8Hlr
wrW7uQPImbX1YzvjycQ7yr1VVZjoubuJLodMoeYdYscGKFaPium4TWfHWqjHpgpz
XI5OWzMPS5MXN7d3LXO8NpXa7az8SSorFMKBCBFcsWrLdboEXcSiGt+R3jqJ/KgC
fCm/qmLPtQ9bXjaZsZ1Uj7tn7XnZ2GClXslggfNKIB+AgaVDeG6fHhbn2YBuFg/d
x2YhZ2ZRKU5jnw0mcD0r/YXV3GCB9zrT4GYFh4Ro0zidsE5vT4k=
=gPPx
-----END PGP SIGNATURE-----

Message #41 received at 847805@bugs.debian.org (full text, mbox, reply):

From: Mattia Rizzolo <mattia@debian.org>

To: Alastair McKinstry <mckinstry@debian.org>

Cc: 847805@bugs.debian.org

Subject: Re: Bug#847805: marked as done (reprotest: document/support simple reproducibility test with sbuild)

Date: Sun, 15 Jan 2017 16:13:17 +0100

[Message part 1 (text/plain, inline)]

Control: reopen -1

Hi Alastair!

I don't think you wanted to close this bug (a bug in src:reprotest)
with your openmpi upload! :)

-- 
regards,
                        Mattia Rizzolo

GPG Key: 66AE 2B4A FCCF 3F52 DA18  4D18 4B04 3FCD B944 4540      .''`.
more about me:  https://mapreri.org                             : :'  :
Launchpad user: https://launchpad.net/~mapreri                  `. `'`
Debian QA page: https://qa.debian.org/developer.php?login=mattia  `-

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.