This month, I created several bugreports and patches,
while working on the NLnet-funded project about creating a 100% bit-reproducible OS (RBOS) [1].

I also worked towards the bot that checks reproducibility of SRs to Factory.
The prototype of the OBS-project-setup is in https://build.opensuse.org/project/show/home:bmwiedemann:reproducible:rebuild
it already shows identical results with
for r in j1 future1y openSUSE_Factory ; do osc api "/build/home:bmwiedemann:reproducible:rebuild/$r/x86_64/_repository?view=binaryversions" | grep libzzip ; done
And different results with grep theunreproduciblepackage\\.rpm

Additionally my reproducible-faketools got an overhaul to get rid of package-conflicts to make them even more versatile and useful, especially within OBS.
They are now in Factory to allow easy testing in more places.

Finally, I am happy to report that a bit-reproducible libreoffice is already in the devel-project.


The Plan for RBOS:

to reach the goal of a distribution that consists of 100% bit-reproducible packages, we need to address multiple issues.
1. newly unreproducible packages get submitted regularly and we need to test + notify these to slow down the introduction of new issues.
A PoC works in https://build.opensuse.org/project/show/home:bmwiedemann:reproducible:rebuild by using a constant Release and distribution value, omitting disturl and adding in some variations via reproducible-faketools in the prjconf. TODO: This needs to be integrated in the workflows for staging + review of submissions to openSUSE:Factory.
2. Some (undroppable) existing packages have variations - several fixes were already submitted and more are to come.
3. Some packages built in OBS are modified by pesign to make them work with secure boot, e.g. grub2 and systemd - TODO - disable obs-pesign-integration? Build these outside of OBS as reference? Use a patched obs-pesign-integration version?
4. https://build.opensuse.org/project/show/home:bmwiedemann:reproducible:distribution:ring0 is already setup and ring1 will come soon with more packages required to build a MinimalVM image or maybe even a DVD. The only open issue in ring0 is with pam:full pdf timestamps from xmlgraphics-fop.




[1] https://nlnet.nl/project/Reproducible-openSUSE/