Reproducible builds

[Frédéric Pierret]

Hi,

As discussed few weeks ago, I'm working on reproducible builds for Fedora. I've
submitted a request for review for new packages:
https://bugzilla.redhat.com/show_bug.cgi?id=1924918. Notably, reprotest is a striking tool
to test reproduciblity by changing multiples build factors (time, user, lang, etc.) and
highlight differences (if exists) with diffoscope (see
https://salsa.debian.org/reproducible-builds/reprotest).

On the same topic, I'm developing rpmreproduce (see
https://github.com/fepitre/rpmreproduce) which is very much work in progress. This tool
allows to rebuild a RPM with the same environment, packages versions etc. This is in the
continuity of a previous attempt https://github.com/kholia/ReproducibleBuilds. Currently,
it uses a "buildinfo" file as input (see
https://wiki.debian.org/ReproducibleBuilds/BuildinfoFiles) but there is not such file in
Fedora (yet?). In Qubes OS, we use an original implementation for RPM done at the occasion
of Reproducible Builds summit:
https://github.com/QubesOS/qubes-builder-rpm/blob/master/scripts/rpmbuild... or
https://raw.githubusercontent.com/fepitre/rpmreproduce/master/scripts/rpm... (latest
dev/test version). This tool is in charge to download exact version dependencies as
specified in the buildinfo, create a local repository, download the corresponding source
RPM and then, rebuild it with mock and only this locally created repository that reflects
the original build environment.

I take this opportunity to invite RPM devs to discuss about a possible upstream
implementation of buildinfo file format. For example, we could think about having a
buildinfo file automatically generated by rpmbuild as dpkg is doing similarly in Debian. I
would be happy to do the work for that.

Best regards,
Frédéric