Re: Idea for implementing reproducible builds

[Claudius Heine <claudius.heine.ext@siemens.com>]

Hi,

On 2018-05-23 10:22, [ext] Claudius Heine wrote:
>>
>> U3.2. debian-mirror exists. Update chosen packages from upstream into
>>        debian-mirror. E.g., openssl, optionally its dependencies, 
>> optionally its
>>        dependents.
> 
> Currently that means that the apt index needs to be updated partially.
> I don't know if its possible to update this index on a package + 
> dependency level, but I doubt it.
> The result of this is that we need to merge upstream index with our own 
> and pin all other packages to the old version.
> 
> Even if we just create a complete mirror of all debian mirror, updating 
> just one package with its dependencies is a serious scripting effort.
> 
> Because of the complexity involved I would postpone this feature.

About this point. One way to implement this on top of this 
implementation could be:

     1. Use a script that takes a packagename and repository path and
        then generates a list of deb packages that describe the current
        version of this package + its dependencies.
     2. This list of packages can be inserted into a bitbake recipe,
        which downloads those packages, adds them into the isar-apt
        repository and installs them to the root file system.

This way we would be explicit about these partial updates. Of course 
this script that parses the apt repo might become complex, but there 
might be some libraries or tools I currently don't know about to help here.

TBH I'm mainly an Archlinux user, and with Archlinux partial updates 
aren't supported, so I am a bit worried about this feature. It may be 
alright to use this in Debian but I have no idea how good that works in 
practice. So being very explicit when using it might be a good way to do 
this.

---

I also took a look at aptly [1]. What aptly is missing AFAIK is a way to 
operate as an apt caching proxy. I mean by this that the mirror command 
does not download all packages just the index and that the packages will 
be downloaded by apt requesting them instead of using the 'aptly repo 
import' command. Maybe if that can be implemented in aptly that might be 
an alternative to this approach. Partial updates might then be easier to 
do then.

Claudius

[1] https://www.aptly.info

-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-54 Fax: (+49)-8142-66989-80 Email: ch@denx.de