debaudit: a new service to verify the reproducibility of Debian source packages

--Rkp8vh9Qj3xIC4zt
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Hi,

I am pleased to announce a new service: debaudit (https://debaudit.debian.net/).

debaudit verifies the integrity and reproducibility of Debian source packages.
It currently includes three checkers:

1. upstream2orig: Verifies that the upstream tarball (e.g., .orig.tar.gz)
   in Debian is a faithful representation of the original source code
   released by upstream developers.
2. git2dsc: Verifies that the source package built from the Vcs-Git
   repository matches the source package currently in the Debian archive.
3. git2orig: Verifies that the orig tarball generated from the Vcs-Git
   repository matches the orig tarball in the archive.

debaudit complements the work of the Reproducible Builds project. While
reproduce.debian.net (https://reproduce.debian.net/) focuses on ensuring
that binary packages can be bit-for-bit reproduced from their source
packages, debaudit focuses on the preceding step: ensuring that the
source package itself is a faithful and reproducible representation of
its upstream source or Vcs-Git repository.

Results from debaudit are integrated into the Debian Maintainer
Dashboard (https://udd.debian.org/dmd/), where a dedicated "debaudit"
column shows the status for your packages. They are also available via
the UDD reproducibility dashboard
(https://udd.debian.org/reproducibility/).  You can also browse detailed
reports and statistics directly on https://debaudit.debian.net/.

Lucas

--Rkp8vh9Qj3xIC4zt
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE/t7ByzN7z1CfQ8IkORS1MvTfvpkFAmm0dmEACgkQORS1MvTf
vpkBKw//ayzLTEdw4WrDZqTQxtPmgQvMuo4WUH+PU+VIhKlJlrdTQGJFRlxoKi4i
ruBnkZeMSiNSAXysINHcrHpdoDk+oR1DLfQvKVQ9LCiy1TH1K5uaCN7GIOIRMoxx
4x3QiG/o7xopxb1Zh9jg7oGF0bFB5onxWPE7hRcgfKFY8mrhIaQNr2GB3QZAZg7Q
79nPBbfUW4ZngcaaXELCMLkGX8YlqedP86xpLkDagwtX3C476no7V2VjRN5vVwLM
WeNurG7rpgc9qzEfNJWCxuG2+08vON9fIfadKwDl8glAgUJlOvMMz8oJ8GBLpYU/
hsF9TueiXRjqWr7uYxZ11h64vyVuIge8+0l4VfmMVqbrPU4j9WTar3TYYevo9O/d
X0ugeBbUZnjlj6Ir9RcLtgIK5STMaHD35jQ5ITU29PUO7JxNKi1J/ID6TntRXh83
73ZHxV3OFU2fE8x55D/6ktScwP6pdiqFteuz87/N5pXvMAlDFs8nFnaI8RAoJ8Gy
tBazGSnVdmLCgvbGxHKDcMuL1ei5cT89lndQdK+r6LhTKNWuwni+O/xLg0+MFGH4
IFV90LvlxsMXCSfb4SDhRu5PIGnt/AyQkvfejNNJ+OHDG1sq5xjU+tmm8URnd6z2
+dgBkrA+g9xFR7qGUOWO+RGaqJrAJP5g7yC3SscJ/RKu0ekU92k=
=VUVk
-----END PGP SIGNATURE-----

--Rkp8vh9Qj3xIC4zt--