Nice, thank you for working on this! Please add comments to your changes, explaining the reasons. It would be ideal to propose upstream changes that make patches unnecessary.

Also you shouldn't put the details in the commit headline, they should be in the description text.

Added a comment in the Nix expression and reformatted the commit message.

How would I go about contacting Perl upstream maintainers? I'm afraid I am not used to contributing to such long-established projects (or open-source projects in general to some extent) …

Yeah it can be a bit intimidating. You usually start by looking at the meta homepage attribute and go from there. In this case that leads to https://www.perl.org/community.html. Maybe just ask on their IRC if this is an issue they'd consider fixing and how best to go about it?

cc @volth

The idea is that since the bootstrap files are pulled in as trusted binaries, they (and everything on the path to building them) should at least be reproducible. With a second patch to make-bootstrap-tools.nix I have everything (in that dependency graph) except GCC building deterministically and idempotently on my machines (and, on my as of yet unpublished ppc64le port, all of it). So this is one step to making this critical piece of infrastructure reproducible.

Re: fontforge building fixed-output derivations: those don't result in the same file on ppc64le BTW.

After talking to some perl packagers and looking into how Debian package their perl, I've rewritten the PR to use some config overrides instead of using a patch to rip out offending lines. I don't have the time to test it in any real capacity today, I'll write back tomorrow.

LGTM, but it would be nice to see the rationale
.
I see that we gave up the neurotic goal of total reproducibility keeping it only for the packages which really need it (for example, fontforge which builds fixed-output-derivations of fonts and leaks own compilation time/user into the font metadata)

Did we give that up? I think it is a very practical goal with big advantages. Everything is not practical, but I'm happy about every additional reproducible package. I see that the effort has stalled a bit, but I would be sad if we actually gave that up.

@CrystalGamma nice, keep us updated when you tested it.

And you even found a place to report it upstream, awesome :)

I've run the test suite, and it seems to produce one more failure than staging, which is weird since it seems to be a part of the language itself rather than anything interacting with the system (specifically it is t/op/each). I'll investigate it some more …

Are there any updates on this pull request, please?

Any updates?

Hi! I agree that the perl build should be reproducible, will try to have a look at this PR a bit later.

Some links on the current status in Debian/Arch/openSUSE:

• https://ismypackagereproducibleyet.org/?pkg=perl&query=query (In openSUSE it's marked as reproducible)
• https://build.opensuse.org/package/show/openSUSE%3AFactory/perl
• https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/perl.html
• https://tests.reproducible-builds.org/archlinux/core/perl/perl-5.32.0-3-x86_64.pkg.tar.zst.html
• https://bugs.debian.org/972559
• Reproducibility support Perl/perl5#16657

Rebased this PR against master in stigtsp@ebfa253, and did a build (with --check) of perldevel on two separate NixOS machines.

The both return:

$ nix-hash --type sha256 /nix/store/ysmbh64nhzjhjkvjh0cl5pv6ikc7njqk-perl-5.33.4
f8fc41bb8faafc5e644caf71d3ef18ca1cc103c424c9b254e4364fd225d78280

Both outputs give the same hash, appears to be reproducible.

Running NixOS on my MacBook Pro 11,1:

$ git remote add -f stigtsp git\@github.com\:stigtsp/nixpkgs
$ git checkout ebfa2534e97fb3e8150deed2618f0a862aae8af6
$ nix-hash --type sha256 $(nix-build -A perldevel)
# -- snip --
f8fc41bb8faafc5e644caf71d3ef18ca1cc103c424c9b254e4364fd225d78280

@CrystalGamma Sorry, this has taken a while. But are you available to continue this PR? If not, I'm happy to move your contributions to a new PR and work on finishing it.

openSUSE's reproducibility patches:
https://github.com/bmwiedemann/openSUSE/blob/master/packages/p/perl/perl-reproducible.patch
https://github.com/bmwiedemann/openSUSE/blob/master/packages/p/perl/perl-reproducible2.patch (to drop ASLR influences in the last bits)

I marked this as stale due to inactivity. → More info

#142942