Reproducible NetBeans

[Emilian Bold]

Now that we are under Apache you might also try using our mailing
lists (eg. dev at netbeans.incubator.apache.org ) to discuss dependency
issues and such. Feel free to contact me directly too for build
problems, I might be able to help.

Once we start doing builds under Apache we could figure out how to
help Debian too. Using newer dependencies at least should be easy to
argue for.

The hg.netbeans.org/binaries "repository" will be decommissioned in
the future and we will get most of our dependencies from the Maven
repo. It probably doesn't help you much, but it should be more in line
with other Java projects.

If reproducible builds are about dh-strip-nondeterminism and
timestamps then I am good to go already with my own patch. (Well,
actually, there is another problem with some generated code that's not
deterministic but you probably didn't run into that since you aren't
including all the modules).


--emi


On Fri, Jul 14, 2017 at 12:22 AM, Markus Koschany <apo at debian.org> wrote:
> Hello,
>
> Am 13.07.2017 um 19:41 schrieb Emilian Bold:
>> Hello,
>>
>> I knew about reproducible-builds.org but I had no idea you are
>> building NetBeans too
>> https://tests.reproducible-builds.org/debian/rb-pkg/stretch/amd64/netbeans.html
>>
>> Which seems to be failing at the moment.
>
> Netbeans is currently maintained by Debian's Java team but I am more or
> less the sole human maintainer. You will find more useful information
> and links about Netbeans in Debian at
> https://tracker.debian.org/pkg/netbeans .
> The reproducible builds effort is coordinated by the Reproducible builds
> team. [1] I suggest to join their mailing list or IRC channel if you are
> interested in this topic. They will surely help you to get a
> reproducible build environment running. See also [2] for more links.
>
>> I've also looked into reproducible builds for Apache NetBeans a while
>> back and have a draft patch prepared for when we start doing builds
>> under Apache (see
>> https://github.com/emilianbold/reproducible-nextbeans/commits/master )
>>
>> So, do you need any help? Do you have patches I could integrate upstream?
>>
>> I'm looking at https://sources.debian.net/src/netbeans/8.1%2Bdfsg3-2/debian/patches/reproducible-build.patch/
>> and the reproducible patch is very small.
>
> The reproducible-build.patch is straightforward. In general I suggest
> you should prune Netbeans of any timestamps. In this case I chose a
> fixed date for the installation time but I'm sure there is a better
> solution. There are more issues with embedded timestamps in zip files
> but I haven't started to work on it.
>
> I would gladly accept help and recommendations how to maintain Netbeans
> for Debian long term. We are the only Linux distribution that provides a
> self-contained build of Netbeans. As you can see at [3] we carry a lot
> of patches despite the fact that we only build the basic cluster, the
> core of Netbeans. Most issues stem from using Debian packages for
> building Netbeans instead of downloading them from your repository. All
> patches that are prefixed with netbeans-* either deal with disabling
> downloads from untrusted sources or fixing build failures due to
> unavailable build-dependencies. The third category of patches deals with
> incompatibilities between different versions of dependencies. Sometimes
> we ship older packages but often also newer ones and the patches try to
> fix or work around those discrepancies.
>
> So in short: I believe most of them are Debian specific unless you
> completely change your build system.
>
>> I assume you also apply strip-nondeterminism on the output archives?
>
> Yes, that's correct. However this tool is part of
> dh-strip-nondeterminism [4] which is automatically called by dh, a core
> tool of debhelper which is used by the majority of all Debian packages.
> It is not specific to Debian's Netbeans package.
>
>> I would also appreciate a quickstart on getting the Debian
>> reproducible build environment setup on a machine so I can test it
>> myself.
>
> As previously suggested I would ask the reproducible builds team for
> help here. [1]
>
> Regards,
>
> Markus
>
>> This is the maintainer address of Debian's Java team
>> <http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-java-maintainers>. Please use
>> debian-java at lists.debian.org for discussions and questions.
>>
>
> [1] https://wiki.debian.org/ReproducibleBuilds/Contribute
> [2] https://wiki.debian.org/ReproducibleBuilds
> [3]
> https://anonscm.debian.org/cgit/pkg-java/netbeans.git/tree/debian/patches
> [4] https://tracker.debian.org/pkg/strip-nondeterminism
>