Software Freedom Conservancy, the fiscal sponsor for the Reproducible Builds project, have announced their fundraising season with a huge pledge to match donations. If you have been considering joining as a supporter, now would be the time to do so.
Here is my monthly update covering what I have been doing in the free software world during November 2019 (previous month):
As part of my duties of being on the board of directors of the Open Source Initiative I attended our autumn face-to-face meeting hosted by Zolando in Berlin, Germany. I also participated in various licensing and other discussions occurring on the internet, as well as the usual internal discussions regarding logistics, policy, etc. liasing at times with the ClearlyDefined project.
Started early conversations as the Head Judge for the next interation of the OpenUK awards to be given out in June 2020.
As part serving on board of the Software in the Public Interest, Inc. I attended my first face-to-face meeting in Manhattan, New York which was graciously hosted by Hudson River Trading. It was great to meet the rest of the board in person after talking at such length over the internet.
Opened pull requests to make the build reproducible in:
Even more hacking on the Lintian static analysis tool for Debian packages:
- Don't emit changelog-file-missing-explicit-entry for stable updates. (#944098)
- Don't complain about long descriptions or
Build-Idfields that appear to be too long. (#942493)
- Don't emit debian-rules-not-executable if
debian/rulesis a symlink as we warn about this via debian-rules-is-symlink. [...]
- Don't emit package-supports-alternative-init-but-no-init.d-script when we have a
- Correct logic when excluding
.service pairsfrom systemd-service-file-missing-install-key. (#944145)
- Don't emit systemd-service-file-missing-install-key for
.servicefiles with corresponding
- Don't emit missing-depends-on-sensible-utils for
Whilst anyone can inspect the source code of free software for malicious flaws almost all software is distributed pre-compiled to end users.
The motivation behind the Reproducible Builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised.
Conservancy acts as a corporate umbrella, allowing projects to operate as non-profit initiatives without managing their own corporate structure. If you like the work of the Conservancy or the Reproducible Builds project, please consider becoming an official supporter.
Conservancy's fundraising season has begin in earnest with a huge pledge to match donations from a number of illustrious individuals. If you have ever considered joining as a supporter, now would be the time to do so.
This month, I:
Categorised a large number of packages and issues in the Reproducible Builds "notes" repository.
I spent a few moments on our website this month too including dropping the duplicated use the term "community" and other words [...][...], correcting the capitalisation of GitHub & GitLab [...] and corrected the use of "an" [...].
Drafted, published and publicised our monthly report.
strip-nondeterminism is our tool to remove specific non-deterministic results from a completed build. This month, I added
fileas a dependency for
libfile-stripnondeterminism-perl(#945212) and moved away from deprecated
Did some arrangement, organisation and financial administration regarding our upcoming summit meeting in Marrakesh, Morocco.
I also made the following changes to diffoscope, our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues:
New features / improvements:
- Allow all possible
.zipfile variations to return from external tools with non-zero exit codes, not just known types we can identify (eg. Java
.buildinfofile matching to files in ASCII or UTF-8 format. (#77)
- Bump the previous
max_page_sizelimit from 400 kB to 4 MB. [...]
- Clarify in the HTML and text outputs that the limits are per-format, not global. (#944882)
- Don't use line-base dbuffering when communucating with subprocesses in "binary" mode. (#75)
- Allow all possible
- Refresh the OCaml test fixtures to support versions greater than 4.08.1. [...]
- Update an Android manifest test to reflect that parsed XML attributes are returned in a new/sorted manner under Python 3.8. [...]
- Dramatically Truncate the tcpdump expected diff to 8KB from ~600KB to reduce the size of the release tarball. [...]
- Add a self-test to encourage that new test data files are generated dynamically or at least no new ones are added without an explicit override. [...]
- Add a comment that the
text_ascii2fixture files are used in multiple tests so is not trivial to remove/replace them. [...]
- Drop two more test fixture files for the directory tests. [...]
- Don't run our self-test against the output of the Black source code reformatter with versions earlier than ours as it will generate different results. [...]
- Update an XML test for Python 3.8. [...]
- Drop unused an unused
5:5.0.7-1) — New upstream release.
3.0~rc1-1) — New upstream releases.
2.13+dfsg-1) — New upstream release.
1.00-4) — Prevent a build failure when multiple Python version libraries exist in the build tree by manually deleting all but the version for the default Python version returned by
py3versionsprior to running the test suite. (#944911)
20.0.2-1) — New upstream releases.
I also sponsored an upload of adminer (
4.7.5-1) of behalf of Alexandre Rossi.
Debian bugs filed
golang-github-nrdcg-goinwx: Please update/expand the "Andrew" copyright holder. (#944066)
/usr/libsymlinks point to an (absolute) build directory. (#943955)
Investigated and triaged dia, freerdp, freetds, gnupg2, inetutils, jetty8, libjackson-json-java, libvpx, llvm-toolchain-6.0, mailutils, netkit-telnet-ssl, proftpd-dfsg, python-reportlab, ruby-rack-cors, ruby2.1, shiro, simplesamlphp, symfony, tnef, vino, wordpress & xcftools.
Frontdesk duties, responding to user/developer questions, reviewing others' packages, participating in mailing list discussions, etc.
You can find out more about the project via the following video:
As a Debian FTP assistant I ACCEPTed 21 packages: golang-github-boj-redistore, golang-github-dchest-uniuri, golang-github-jackc-fake, golang-github-joyent-gocommon, golang-github-mattetti-filebuffer, golang-github-nrdcg-goinwx, golang-github-pearkes-dnsimple, golang-github-soniah-dnsmadeeasy, golang-github-vultr-govultr, golang-github-zorkian-go-datadog-api, meep, meep-mpi-default, meep-openmpi, node-eslint-plugin-requirejs, node-i18next, node-node-sass, node-re2, ocplib-endian, python-asynctest, python-janus & python-matrix-nio.