GH-49988: [CI][Packaging] Enable reproducible builds on host for APT based Linux packages#48148
GH-49988: [CI][Packaging] Enable reproducible builds on host for APT based Linux packages#48148raulcd wants to merge 13 commits into
Conversation
|
|
|
@kou I was able to spend some more time here and with the help of Claude I was able to get successful Debian reproducible builds. The current CI failures are just timeouts, I should increase the timeout on this branch. I've also spent some more days to try and get RPM's also reproducible but I haven't been able to achieve it so far. |
|
Great! Let's work on RPM's reproducible builds as a separated work! |
| # Use a fixed build directory name instead of mktemp's random suffix. | ||
| # c_glib's meson generates pkgconfig files that bake the absolute | ||
| # build-tree path into Libs.private, so a random suffix breaks | ||
| # reproducibility across reprotest runs. | ||
| build_dir="${build_root_dir}/package" | ||
| run mkdir -p "${build_dir}" | ||
| run pushd "${build_dir}" |
There was a problem hiding this comment.
I want to keep using random build directory path because it's one of important reproducible build checks. We can work on this as a follow-up task. I'll take a look at Meson.
There was a problem hiding this comment.
I've created a new issue to track this and have added a TODO comment on the code pointing to the new issue:
|
|
|
I've ended up creating two sub-issues one for Debian based and one for RPM based that can be seen in the parent and have updated this PR to point to the Debian based. |
…pparmor permissions and fix patch permission
Rationale for this change
Reproducible builds are a requirement to be able to add automated signing. We would like to be able to do automated signing for our Linux packages too as discussed here:
#47058 (comment)
What changes are included in this PR?
Some minor changes to our build to fix some Reproducible tests errors found. The main addition is adding a new step to our Linux Packaging GitHub actions workflow to run reprotest on the rake tasks to build the packages and compare the artifacts built.
Are these changes tested?
Yes on CI as part of the APT Packaging Linux jobs.
Are there any user-facing changes?