Building Debian source packages reproducibly (was: Re: [RFC] Proposal for new source format)

[Ian Jackson <ijackson@chiark.greenend.org.uk>]

Didier 'OdyX' Raboud writes ("Building Debian source packages reproducibly (was: Re: [RFC] Proposal for new source format)"):
> Where I'm coming from is that we were discussing the tag2upload
> problem at miniDebConf Vaumarcus.  [...]

I appreciate your efforts to try to unstick all this.

> The hard part is not the packing and unpacking of the special tag; that's 
> mostly just strings massaging. But building the exact same source package in 
> different environments is harder than I expected.

Yes.  I have code to do it for tag2upload, though.  It's not released
yet because I stopped putting effort into this whole area after
getting discouraged.

> Of course, all of this can only work if we can have, or make the ".git to 
> .dsc" conversion reproducible; hence my query.
> 
> All-in-all; would this be a welcome mechanism?

I think by requiring the user to always have the tarballs on hand and
wait for them to be manipulated and maybe transferred, you are losing
a fair amount of the benefit of tag2upload.

But if you did want to do something along these lines, maybe you
should do it by adding code to git-debpush and the tag2upload service
rather than by reinventing the rest of the machinery ?

Regards,
Ian.

-- 
Ian Jackson <ijackson@chiark.greenend.org.uk>   These opinions are my own.

If I emailed you from an address @fyvzl.net or @evade.org.uk, that is
a private address which bypasses my fierce spamfilter.