openSUSE reproducible builds status (December 28)

Hi,

last month's status:
https://lists.opensuse.org/opensuse-factory/2018-11/msg00...

I uploaded https://rb.zq1.de/compare.factory-20181228/ today
and rbstats are:
total-packages: 11172
build-tried: 11167
build-failed: 34
build-n-a: 105
build-succeeded: 11028
build-official-failed+na: 140
build-compare-failed: 286
build-compare-succeeded: 10742
bit-by-bit-identical: 10482
not-bit-by-bit-identical: 544


Last months' r-b project updates (including my work):
https://reproducible-builds.org/blog/posts/191/
https://reproducible-builds.org/blog/posts/190/
https://reproducible-builds.org/blog/posts/189/
https://reproducible-builds.org/blog/posts/188/
https://reproducible-builds.org/blog/posts/187/


I filed https://github.com/openSUSE/open-build-service/issues/6690
"New binaries published under old names - confuses tools"


Fixed core packages since last month:
  plasma5-desktop https://bugzilla.opensuse.org/show_bug.cgi?id=1109420

  openmpi2 https://build.opensuse.org/request/show/652140
    sort+date+time+host+user

  evolution https://gitlab.gnome.org/GNOME/evolution/issues/196

Nearly fixed:

  opa-ff
   CPU-detection via -march=native
   https://build.opensuse.org/request/show/661771

  gengetopt
   https://build.opensuse.org/request/show/661735

  breeze5-icons dolphin libqt5-qtwebkit wireshark syntax-highlighting:
   Qt rcc/qrc fix merged https://codereview.qt-project.org/243636

  xen - gets (unavoidable?) variations from pesign-obs-integration.
   https://build.opensuse.org/request/show/644624 was merged.
   One minor fix was reverted for
https://bugzilla.suse.com/show_bug.cgi?id=1116524
   One xen/binutils patch is hard to upstream, but fixed in our package
at least.


Of the 286 packages with major issues,
there are 4 in Ring0 and 48 in Ring1:

--- ring0 ---
acl
gcc7
gcc8
perl

--- ring1 ---
MozillaFirefox
MozillaThunderbird
ant
breeze5-icons
bsf
colord
dolphin
emacs
firebird
gconf2-branding-openSUSE
gdb
gimp
gnome-documents
go1.10
go1.11
groff-full
grub2
hamcrest
installation-images
java-11-openjdk
java-1_8_0-openjdk
jing-trang
jtidy
junitperf
kernel-debug
kernel-default
kernel-vanilla
kubernetes
libkolabxml
libqt5-qttools
libqt5-qtwebkit
libreoffice
mono-core
mozilla-nss
pcp
pcre2
php7
python-base
python3-base
release-notes-openSUSE
ruby2.5
rubygem-gem2rpm
rust
syntax-highlighting
transfig
virtualbox
wireshark
xmlbeans


If you are interested in why they vary:
acl:
  date+time in /usr/share/locale/en@boldquot/LC_MESSAGES/acl.mo
-PO-Revision-Date: 2018-10-23 01:45+0000
+PO-Revision-Date: 2033-11-24 15:01+0000

gcc7 gcc8:
  indeterminism from PGO/parallelism + mtime. See also
https://github.com/bmwiedemann/theunreproduciblepackage/t...

perl:
  ASLR-induced randomness in
/usr/lib/perl5/5.28.1/x86_64-linux-thread-multi/Storable/Limit.pm - sent
a simple (maybe insufficient) patch

https://www.nntp.perl.org/group/perl.perl5.porters/2018/1... ;
disabling ASLR during build would also be an option.

MozillaFirefox MozillaThunderbird:
  date+time, rust, other
  has bug around update.locale symlink
/usr/lib64/firefox/libxul.so varies from
https://github.com/rust-lang/rust/issues/57041
.../browser/extensions/langpack-ca@firefox.mozilla.org/manifest.json
-      "version": "20181009013946"
+      "version": "20331110172641"


apache-commons-lang3 apache-pdfbox dom4j hsqldb icu4j javassist
jing-trang jtidy junitperf jython objectweb-asm tomcat xerces-j2 xpp2 xpp3:
  date + mtime
  in .jar + javadoc html
  can be normalized by strip-nondeterminism


bsh2 cglib:
  /usr/share/maven-metadata/bsh2.xml has ASLR order issues
  date + mtime in .jar + javadoc html


colord
  some randomness from uninitialized memory
  maybe from glib-compile-resources
  16-byte random profileID in .icc files from cd-create-profile
  plus an uncommitted date/time fix in lib/colord/cd-it8.c:
  priv->enable_created = FALSE


ecj
  ASLR + date?
  /usr/share/maven-metadata/ecj.xml has alias entries in random order


emacs
  dumps lisp interpreter memory to create its binaries
  (similar to clisp)
  causes variations in /usr/bin/emacs-*


firebird:
  ships unreproducible database
  http://tracker.firebirdsql.org/browse/CORE-5548

gconf2-branding-openSUSE
  embeds mtime values in
  /etc/gconf/gconf.xml.vendor/%gconf-tree.xml

gdb
  contains testresults
  https://bugzilla.opensuse.org/show_bug.cgi?id=1110708

gimp
  ASLR
  12 byte differ in bKGD header
  from gegl
GEGL_USE_OPENCL=no GEGL_SWAP=ram /usr/bin/gegl
../../icons/Symbolic/64/gimp-texture.png -o 64/gimp-texture.png --
gegl:invert-gamma

gnome-documents
  gnome-documents-getting-started.pdf has random ID from inkscape

go1.10 go1.11:
  variations in /usr/lib64/go/1.10/pkg/obj/go-build/*/*-a

groff-full
  date+time + unknown reason?
  .ps files vary
  .html files have CreationDate

grub2
  mtime + readdir
  https://savannah.gnu.org/bugs/index.php?54841

hamcrest
  java .class files vary from
build/temp/hamcrest-core/generated-code
/org/hamcrest/CoreMatchers.java written by ant
  javadoc html varies

installation-images
  many variations from mtimes + filesys/readdir and %post scripts

java-1_8_0-openjdk java-10-openjdk java-11-openjdk
  various .jar .zip .html .jmod
  ordering in /usr/lib64/jvm/java-10-openjdk-10/lib/classlist

kernel-debug kernel-default kernel-vanilla
  date+time ; random keys?
  "Build time autogenerated kernel key0
  ..181009012108Z..21180915012108Z0.1,0"

kubernetes:
  fixed upstream: order in man-pages
https://github.com/kubernetes/kubernetes/pull/68983
  maybe fixed upstream: random build-ids

libkolabxml
  unknown/ASLR?
  from build/kolabformat-xcal-schema.cxx
  created by compiled/xsdbin.cxx

libqt5-qttools
  filesys order ; other

libreoffice
  various .jar .so .dat/.bau (.zip) javadoc_log.txt

mono-core
  date+time ; other

mozilla-nss
  DSA random temp-key from shlibsign
  https://bugzilla.opensuse.org/show_bug.cgi?id=1081723

pcp
  /var/lib/pcp/testsuite/perfevent/perfevent_coverage has random diffs
  from gcov / .gcno files causing diff in .o ?

pcre2
  PGO

php7
  date / EPOCH timestamps
  e.g. in /usr/share/php7/PEAR/.channels/__uri.reg

python-base python3-base:
  PGO
  varies .o files that go into /usr/lib64/libpython3.6m.so.1.0
  .pyc files vary
  python-base shows influence from date+hostname (in PGO?)

python-numpy
  1 .pyc file varied

release-notes-openSUSE
  partial fix in https://github.com/openSUSE/daps/issues/482
  date+time in .pdf ; needs work on fop java code
  random id values in .html

ruby2.5
  2 gemspec files have date
  created.rid varies

rubygem-gem2rpm
  mtime ?
  /usr/lib64/ruby/gems/2.5.0/cache/checksums.yaml varies

rust
  asm diffs in cargo and others
  - filed at https://github.com/rust-lang/rust/issues/57041

tigervnc
  date+time+randomness in
  /usr/share/vnc/classes/META-INF/TIGERVNC.RSA
  from SignJar.cmake calling jarsigner with temporary private key
  partial fix merged https://github.com/TigerVNC/tigervnc/pull/765

transfig
  date+time
  in sample-presentation.pdf /CreationDate /ModDate
  from pdflatex

virtualbox
  tar + random
  https://www.virtualbox.org/ticket/16854
  .so files have random NT_GNU_BUILD_ID (unique build ID bitstring)
  maybe from out/linux.amd64/release/obj/webservice/gsoapH_from_gsoap.h
  that has date+time in comment
  /usr/share/virtualbox/extensions/VNC-5.2.16.vbox-extpack
  unhandled gzip content: POSIX tar archive (GNU)
  -13343137165.010505. 5...
  +16773576625.010527. 5...


xmlbeans
  index.xsb varies from filesystem
  created in org.apache.xmlbeans.impl.tool.SchemaCompiler



additionally, on the SLE15 list
===============================

gnuplot
  date+time in pdf from pdflatex

golang-github-prometheus-prometheus
  date+time+random build-id

hawk2
  https://bugzilla.opensuse.org/show_bug.cgi?id=1112159

ibus-libzhuyin libpinyin libzhuyin
  random bytes - maybe uninitialized memory

perf
  random filesys order
  from nftw call in ./linux-*/tools/perf/pmu-events/jevents.c

python-keystoneauth1
  https://bugs.launchpad.net/keystoneauth/+bug/1796899


Ciao
Bernhard M.
-- 
To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org
To contact the owner, e-mail: opensuse-factory+owner@opensuse.org