[Reproducible-builds] introducing srebuild (was: Re: introducing buildinfo2snapshot)

[Johannes Schauer]

Hi,

Quoting Johannes Schauer (2014-12-31 16:42:04)
> today I skimmed the ReproducibleBuilds wiki page and read that "A build tool
> that would reproduce a build environment using packages from
> snapshot.debian.org is still missing.".
> 
> As I understand it, this task mainly boils down to finding a snapshot that all
> package versions in the .buildinfo file have been retrieved from. The following
> Expat licensed Python script tries to figure this out:
> 
> https://github.com/josch/buildinfo2snapshot
> 
> This is just a proof of concept. If what I'm doing there is found to be sane,
> I'll clean this script up and maybe it could be integrated in a package like
> devscripts?

this is now also outdated.

Today I worked on a sbuild wrapper called srebuild. It uses sbuilds hook
functionality (needs #774359 to be fixed) to install the right dependencies
from a .buildinfo into the sbuild schroot.

Current limitations:

 - it will only search for results in Debian Sid, main
 - it will start with a wheezy chroot and not yet select one automatically by
   using the base-files version as a guide
 - it is limited to finding a single snapshot timestamp and will error out if
   not all package versions can be found in a single timestamp

Neither of the above limitations has a fatal blocker and I will improve these
things in the future.

And even with those limitations, the current state should already be usable in
lots of situations.

Example:

 - download the .buildinfo file from https://wiki.debian.org/ReproducibleBuilds/BuildinfoSpecification
 - get the dsc file from some mirror
 - run: srebuild fweb_1.62-12_i386.buildinfo

It will build the dsc referenced by the .buildinfo and will also verify the
integrity of the dsc and the produced .deb packages before and after the build.

Since sbuild is written in Perl I had to port my Python script from above to
Perl (which was a pain since I'm a perl n00b) and since Perl and POSIX shell
are the only scripting languages available in a minimal Debian buildd, the
sbuild hooks are written in Perl too and my life wasn't made easier. This means
that the scripts have several rough edges and that somebody more knowledgeable
in Perl will find many ways to improve my current code.

Bug reports are welcome!

The code is in the sbuild git:

http://anonscm.debian.org/cgit/reproducible/sbuild.git/

Thanks!

cheers, josch