1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
[[!meta title="Reproducible Builds Workshop: Paris 2018" ]]
<div style="width: 48%; float: right;">
[[!img posts/reproducible_builds_2018/rb.svg size=400x ]]
</div>
I travelled to Paris over the last week for the [[Reproducible Builds
workshop|https://reproducible-builds.org/events/paris2018/]] there, as
well as a [[GNU Guix
meetup|https://libreplanet.org/wiki/Group:Guix/ParisGathering2018]] on
the day before. All in all, it's been awesome, if a little tiring.
It was reassuring to spend some time with others who care enough about
free software and related things to take a number of days out to come
together and work on reproducible builds and related topics.
<div>
<div style="width: 48; float: left;">
[[!img posts/reproducible_builds_2018/P1020108.JPG size=400x ]]
</div>
<div style="width: 48%; float: right;">
[[!img posts/reproducible_builds_2018/P1020111.JPG size=400x ]]
</div>
</div>
# Monday, Guix meeting at Inria
<div style="width: 32%; float: right;">
[[!img posts/reproducible_builds_2018/guix.svg size=400x ]]
</div>
I'm very thankful to Ludovic and Inria to organising and hosting the
event.
I've been looking at code review and automated testing in the last few
weeks, and I think the discussions around that did move things
forward.
The issue of substitute delivery for GNU Guix was also discussed a few
times, and at the Reproducible Builds summit, the presence of some
people who were very knowledgeable about IPFS (the Inter Planetary
File System) at the summit were very helpful.
# Tuesday, Start of the Reproducible Builds workshop
The morning was filled with some knowledge sharing sessions, which was
great for me, as this was my first reproducible builds summit.
I know now a little more about the Reproducible Builds organisations
infrastructure, and I discussed the technical side of getting data
regarding the reproducible of Guix packages in to the Reproducible
Builds database.
The agenda and notes for the event are [[available
here|https://pad.riseup.net/p/reproduciblebuilds4-agenda]].
<div style="clear: both;">
<div style="width: 48%; float: right;">
[[!img posts/reproducible_builds_2018/IMG_20181211_133513.jpg size=450x ]]
</div>
<div style="width: 48%; float: left;">
[[!img posts/reproducible_builds_2018/P1020123.JPG size=450x ]]
</div>
</div>
# Wednesday
In the morning, I talked to others in the cross distribution session
on Guix things, issues with upstreams and various [[other
topics|https://pad.riseup.net/p/reproduciblebuilds4-crossdistro]].
I was already thinking about a patch I made to Ruby, and used in
govuk-guix to make downloading Rubygems more reproducible, however I
was hesitant to push it upstream as I wasn't sure it was more
generally useful. I ended up talking about this in the skill share
session, and found someone else who was interested in Ruby
reproducible builds. I've now pushed that [[patch up for
review|https://github.com/rubygems/rubygems/pull/2524]].
<div style="clear: both;">
<div style="width: 48%; float: right;">
[[!img posts/reproducible_builds_2018/IMG_20181212_232630.jpg size=450x ]]
</div>
<div style="width: 48%; float: left;">
[[!img posts/reproducible_builds_2018/IMG_20181212_232644.jpg size=450x ]]
</div>
</div>
# Thursday
I went along to a session on rebuilders, mostly to try and figure out
the relevance to Guix. I have a better understanding of this
now. Guix, and some other projects (Nix, maybe F-Droid, ...) already
have some of the pieces of this just due to how they normally
work. For Guix, the technical side of a "rebuilder" is just a standard
"build farm", ``ci.guix.info``, or ``hydra.gnu.org`` for example.
The client verification with rebuilders is also mostly in place
already for Guix. Whereas in Debian, you need to use the buildinfo
files to check with rebuilders about the results they got, the narinfo
files Guix uses when trying to find substitutes already fulfil this
purpose, just because of how Guix works.
<div style="text-align: center">
<div style="display: inline-block;">
[[!img posts/reproducible_builds_2018/groupphoto_rws4_paris_2018_small.png ]]
</div>
</div>
I'm looking forward to all of the things that these events have
boosted. The next month or two is going to be very interesting, with
things like FOSDEM coming up at the start of February, and Guix maybe
releasing a 1.0 around then.
|