Re: Idea for implementing reproducible builds

[Baurzhan Ismagulov <ibr@radix50.net>]

On Wed, May 23, 2018 at 10:22:10AM +0200, Claudius Heine wrote:
> The tarfile has to be versioned outside of the repo, since there is a
> 1-to-many relationship between the source repo commit and the tarball.
> 
> For instance openssl updates would not necessarly mean a new change to the
> repo, just a new build.

This is why I'd like to see user docs to understand your intended use case.
What should be the names of the tarballs (just one simple example how it could
work)? How would you tell the repo to use the new tarball?


> >U3.1. debian-mirror exists. Update all packages from upstream into
> >       debian-mirror.
> 
> Why is that needed?

For updating debian-mirror completely. 


> You could just delete the debian-mirror and then it is recreated with the
> current upstream anyway.

That answers my question and is ok with me for the first step.


> >U3.4. Remove packages not used in any previous commit.
> 
> I am currently not sure what you mean by that. Why would there be packages
> that aren't used in any previous commits?

Bad wording, I meant just "remove unused packages".


> I look into this and came up with some difficulties when using an
> alternative debian-mirror repo that is generated from the used packages:
> 
>     1. You need to change the apt repo urls. Yes multiple ones since we
>        support multi-repos in isar. How are we handling this? Are we
>        throwing stuff from different repos togehter? Or are we creating
>        multiple locale repos for every used repo and then set them back
>        later? Both solutions can cause (un)expected problems.
>        How are we dealing with updates from upstream then?

As answered in the other mail, you could proceed just as now, with separate
package dirs. Managing a single dir would be better. Package dirs solve those
problems as well as tarballs.


>     2. How are we installing additional packages that are currently not
>        part of the debian-mirror? If its just a different repo those
>        packages would not be part of the package index, so those
>        packages would not be available.

Which additional packages do you have in mind? If hello and friends, the
current installation way should not be changed in this step. If you mean
updating debian-mirror, for now e.g. just delete and start from scratch, as
with tarballs, till we have something that is better.


>        If its a complete mirror of the repos, then it contains many packages
>        that aren't needed.

No, not complete mirrors, just the packages we need from Debian.


With kind regards,
Baurzhan.