[arch-dev-public] Reproducible builds progress and the upcoming rebuild of [core]

[Morten Linderud]

Yo!

Lets keep the momentum up by sharing more great news :)

So all packages in core have now been rebuilt and tested with archlinux-repro.

You can find the list at:
https://wiki.archlinux.org/index.php/DeveloperWiki:ReproduciblePackages

So while most packages are reproducible, 20 packages are not reproducible, and
3(!) packages could not be built.

- popt uses the deprecated rpm5.org address
- pkgconf has moved to sourcehut (https://git.sr.ht/~kaniini/pkgconf)
- iana-etc the sources are not validating

Meanwhile we should try to figure out some solutions for rest of the
non-reproducible ones so we can have a 100% reproducible core repository.

The diffoscope output for all of the 14 packages can be found on my homedir:
https://pkgbuild.com/~foxboron/diffoscope-output-non-reproducible/

Currently havent tried rebuilding linux-lts because of lazyness, but the result
should be the same as for the linux package. I have also packaged up
`archlinux-repro` into community, and Eli has submitted the patches
for the `makerepropkg` tool!

-- 
Morten Linderud
PGP: 9C02FF419FECBE16
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-dev-public/attachments/20191120/8cd34066/attachment.sig>