On 2021-02-27, Holger Levsen wrote: > snapshot.debian.org is an awesome service for the wider free software > community > and especially for those working on reproducible builds. Sadly accessing > *many* > packages from it is limited and troublesome (see below for bug numbers), thus > we (mostly Frédéric Pierret and myself) came up with the idea of setting up a > partial mirror, covering only the years 2017 until now and arch:amd64 and > arch:all > only as well. (for a start, maybe we need 2015+2016 too and maybe we can > afford > to also host arm64 or some other architecture...) ... > #977653 Please document rate limits on snapshots.debian.org > #960304 snapshot.debian.org: Snapshot repo repeatedly cutting off connection, > returning partial content > #969906 snapshot.debian.org: error 500 internal server error after some > requests via Python
I'd like to point out that these issues are basically the last known major blockers to performing verification builds against packages actually in the Debian archive (as opposed to the builds done on tests.reproducible-builds.org, which performs two builds against the current state of archive). Implementing a workaround for the limitations of snapshot.debian.org could move Debian beyond Reproducible Builds in *theory* and into Reproducible Builds in *practice*! Happy to help with this, hope to see it move forward! To further limit the scope, one might also be able to take all the currently relevent .buildinfo files for bullseye and build a list of the package versions needed from that (rather than assuming 2017 as a good baseline). Might be a little trickier to implement, of course... live well, vagrant
signature.asc
Description: PGP signature
_______________________________________________ Reproducible-builds mailing list Reproducible-builds@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/reproducible-builds
