Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create .changes files for reproducible builds #3064

Merged

Conversation

JanZerebecki
Copy link
Member

release rpm files currently do not have .changes files, but these are needed to extract SOURCE_DATE_EPOCH for reproducible builds.

Using the time stamp of the last commit to the input, which is the 000package-groups source package, as the time for the changes entry would be reproducible, however there is resistance to that.

The other date that would is somewhat related is the time of the last source change for any input to the whole distribution, however AFAIK this date is not cheap enough to compute for OBS-VCS. This hopefully changes once we move to git. But I think the change date of 000package-groups makes more sense conceptually, because AFAIK that is the only information that can causes a change.

However to not delay making progress with reproducible builds in Factory, I propose this change which is non-reproducible, by using the current wall-clock time. We can revisit this later.

See https://reproducible-builds.org/ for more general information on this topic.

This is an alternative for: #3062

@DimStar77
Copy link
Contributor

The other date that would is somewhat related is the time of the last source change for any input to the whole distribution, however AFAIK this date is not cheap enough to compute for OBS-VCS. This hopefully changes once we move to git. But I think the change date of 000package-groups makes more sense conceptually, because AFAIK that is the only information that can causes a change.

  • The 000package-releases contains the TW snapshot version - i.e is changed daily
  • The weakremover.inc is updated by a bot and dynamically changes whenever a package is removed - without changes in 000package-groups
    i.e the date of 000package-groups is in no way the only relevant change to the -releases package

@Vogtinator
Copy link
Member

But I think the change date of 000package-groups makes more sense conceptually, because AFAIK that is the only information that can causes a change.

No, as the generated content depends on all other packages in the repo, e.g. version number and weakremovers.

Copy link
Member

@Vogtinator Vogtinator left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is missing the "only if the output changes" part which is important otherwise it would commit changes on every run

@JanZerebecki JanZerebecki force-pushed the sde-create-release-changes-now branch from d555cf0 to 63a8d50 Compare March 8, 2024 12:02
@codecov-commenter
Copy link

codecov-commenter commented Mar 8, 2024

Codecov Report

Attention: Patch coverage is 0% with 14 lines in your changes are missing coverage. Please review.

Project coverage is 28.24%. Comparing base (9919e02) to head (63a8d50).
Report is 28 commits behind head on master.

Files Patch % Lines
pkglistgen/tool.py 0.00% 14 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #3064      +/-   ##
==========================================
- Coverage   28.31%   28.24%   -0.08%     
==========================================
  Files          86       86              
  Lines       14799    14840      +41     
==========================================
  Hits         4191     4191              
- Misses      10608    10649      +41     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@JanZerebecki
Copy link
Member Author

Now it should only change the changes files if there is something else to commit.

Note: after this is merged, the %changelog in the spec.in files in 000package-groups probably needs to be removed before the following run.

pkglistgen/tool.py Outdated Show resolved Hide resolved
release rpm files currently do not have .changes files, but these are
needed to extract SOURCE_DATE_EPOCH for reproducible builds.

Using the time stamp of the last commit to any of the input, which is
the 000package-groups and 000update-repos source package, as the time
for the changes entry would be reproducible, however there is resistance
to that.

The other date that is related is the time of the last
source change for any input to the whole distribution, however AFAIK
this date is not cheap enough to compute for OBS-VCS. This hopefully
changes once we move to git.

However to not delay making progress with reproducible builds in
Factory, I propose this change which makes the output of this script
non-reproducible, by using the current wall-clock time. But only when
this script produced a change to be commited. The release binary rpms
will still be reproducible. We can revisit making the generated source
reproducible, later.

See https://reproducible-builds.org/ for more general information on
this topic.
@JanZerebecki JanZerebecki force-pushed the sde-create-release-changes-now branch from 63a8d50 to 57110cc Compare March 8, 2024 13:28
Copy link
Member

@Vogtinator Vogtinator left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Let's try this next week

@DimStar77 DimStar77 merged commit a2edca4 into openSUSE:master Mar 11, 2024
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants