Reproducible NetBeans

[Markus Koschany]

Hello,

Am 13.07.2017 um 19:41 schrieb Emilian Bold:
> Hello,
> 
> I knew about reproducible-builds.org but I had no idea you are
> building NetBeans too
> https://tests.reproducible-builds.org/debian/rb-pkg/stretch/amd64/netbeans.html
> 
> Which seems to be failing at the moment.

Netbeans is currently maintained by Debian's Java team but I am more or
less the sole human maintainer. You will find more useful information
and links about Netbeans in Debian at
https://tracker.debian.org/pkg/netbeans .
The reproducible builds effort is coordinated by the Reproducible builds
team. [1] I suggest to join their mailing list or IRC channel if you are
interested in this topic. They will surely help you to get a
reproducible build environment running. See also [2] for more links.

> I've also looked into reproducible builds for Apache NetBeans a while
> back and have a draft patch prepared for when we start doing builds
> under Apache (see
> https://github.com/emilianbold/reproducible-nextbeans/commits/master )
> 
> So, do you need any help? Do you have patches I could integrate upstream?
> 
> I'm looking at https://sources.debian.net/src/netbeans/8.1%2Bdfsg3-2/debian/patches/reproducible-build.patch/
> and the reproducible patch is very small.

The reproducible-build.patch is straightforward. In general I suggest
you should prune Netbeans of any timestamps. In this case I chose a
fixed date for the installation time but I'm sure there is a better
solution. There are more issues with embedded timestamps in zip files
but I haven't started to work on it.

I would gladly accept help and recommendations how to maintain Netbeans
for Debian long term. We are the only Linux distribution that provides a
self-contained build of Netbeans. As you can see at [3] we carry a lot
of patches despite the fact that we only build the basic cluster, the
core of Netbeans. Most issues stem from using Debian packages for
building Netbeans instead of downloading them from your repository. All
patches that are prefixed with netbeans-* either deal with disabling
downloads from untrusted sources or fixing build failures due to
unavailable build-dependencies. The third category of patches deals with
incompatibilities between different versions of dependencies. Sometimes
we ship older packages but often also newer ones and the patches try to
fix or work around those discrepancies.

So in short: I believe most of them are Debian specific unless you
completely change your build system.

> I assume you also apply strip-nondeterminism on the output archives?

Yes, that's correct. However this tool is part of
dh-strip-nondeterminism [4] which is automatically called by dh, a core
tool of debhelper which is used by the majority of all Debian packages.
It is not specific to Debian's Netbeans package.

> I would also appreciate a quickstart on getting the Debian
> reproducible build environment setup on a machine so I can test it
> myself.

As previously suggested I would ask the reproducible builds team for
help here. [1]

Regards,

Markus

> This is the maintainer address of Debian's Java team
> <http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-java-maintainers>. Please use
> debian-java at lists.debian.org for discussions and questions.
> 

[1] https://wiki.debian.org/ReproducibleBuilds/Contribute
[2] https://wiki.debian.org/ReproducibleBuilds
[3]
https://anonscm.debian.org/cgit/pkg-java/netbeans.git/tree/debian/patches
[4] https://tracker.debian.org/pkg/strip-nondeterminism

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-java-maintainers/attachments/20170713/6460efc8/attachment.sig>