Re: bits from the release team

Hi all,

On 5/10/26 06:47, Paul Gevers wrote:
> Reproducibility
> ===============
> 
> Aided by the efforts of the Reproducible Builds project [1], we've decided it's
> time to say that Debian must ship reproducible packages. Since yesterday, we
> have enabled our migration software to block migration of new packages that
> can't be reproduced [2] or existing packages (in testing) that regress in
> reproducibility.

I forgot to mention that while we of course want all packages in testing 
to reproduce, we recognize there will be exceptions (which numbers 
hopefully will reduce over time). If you think your package needs an 
exception, please file a bug against the release.debian.org pseudo 
package (option 4 "other" in reportbug for now) and explain why you're 
not able to fix the issue.

I recognize that for packages that are not reproduced because of 
"NT_GNU_BUILD_ID" differences the current diffoscope log is not ideal as 
the real delta is stripped off and probably only visible in the dbgsym 
packages which aren't (currently) part of the automated comparison.

I'd like to iterate what Gioele mentioned earlier in this thread, there 
is a very clear difference in the way reproducibility is tested on 
https://tests.reproducible-builds.org/ vs https://reproduce.debian.net/. 
While the former is a stress test, the latter tries, with the info in 
the .buildinfo file, to reproduce what we ship. It's the latter case 
what some people call "easy", but it's also what matters to our users: 
can the binaries *they* use be reproduced.

For those that want to have an overview of their packages, both 
https://udd.debian.org/reproducibility/ and 
https://qa.debian.org/developer.php show the reproducibility and 
reproduced state.

Paul

-----BEGIN PGP SIGNATURE-----

wsC7BAABCABvBYJqGnnSCRCcXJnrBb11CkcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmeBjW+M8ycJHk+Mlmn5b0LRwu2j+GRklZEhM1kyNzzZ
RhYhBFi2bUhza+k7BS3mcpxcmesFvXUKAAD85Af/cuD+xdYkqkWLdBlyyxghN+f4
nAUm2a7ENQB5tSeudq7wblkgGdAFc29ZwBsM+YxEX5RHDMMASGmzmtQQie1o9Nrk
P/v3QH1aZmd6rSoIKndL7xZvwoMrrA0nSS4A+FVAKEfRNts4LsuZZ2mWTLuQjK11
JB91DtuMmmZrssqiwqqk6aBGS6wkGLaxZsxnuS6EANnT3291hzy6flwmiBLIO/bW
ZgZlP95rUnm9bVc1GvF2xdTk4Tg6WiSIN3N0ml3Fkd+Of2CpR0pZP08HBvsH1i4j
OYHqLJ0MkVT/NgQgpTKEm6U6stRPRpGBgXSp4fOHG52EFE1jxaq4COQdwLqo9A==
=UOxA
-----END PGP SIGNATURE-----