spec: https://fed500.fedorapeople.org/zlib.spec srpm: https://fed500.fedorapeople.org/zlib-1.3.2-1.fc43.src.rpm description: Zlib is a general-purpose, patent-free, lossless data compression library which is used by many different programs fas: fed500 Rationale for bringing this back to Fedora: The package was replaced by zlib-ng which provides a compat package. However, zlib-ng uses compression algorithms that are not fully deterministic, as such cannot be used in pipelines that require reproducible builds and use checksums on compressed artifacts. One way to have both zlib-ng and zlib is to use modules, though other suggestions are welcome. Previous discussion: https://fedoraproject.org/wiki/Changes/ZlibNGTransition Reproducible: Always
Copr build: https://copr.fedorainfracloud.org/coprs/build/10200642 (succeeded) Review template: https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2445516-zlib/fedora-rawhide-x86_64/10200642-zlib/fedora-review/review.txt Found issues: - No gcc, gcc-c++ or clang found in BuildRequires Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/C_and_C++/ - A package with this name already exists. Please check https://src.fedoraproject.org/rpms/zlib, https://src.fedoraproject.org/tests/zlib Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/Naming/#_conflicting_package_names Please know that there can be false-positives. --- This comment was created by the fedora-review-service https://github.com/FrostyX/fedora-review-service If you want to trigger a new Copr build, add a comment containing new Spec and SRPM URLs or [fedora-review-service-build] string.
(In reply to Benson Muite from comment #0) > > The package was replaced by zlib-ng which provides a compat package. > However, zlib-ng uses compression algorithms that are not fully > deterministic, as such cannot be used in pipelines that require > reproducible builds and use checksums on compressed artifacts. One > way to have both zlib-ng and zlib is to use modules, though other > suggestions are welcome. > > Previous discussion: > https://fedoraproject.org/wiki/Changes/ZlibNGTransition > > Reproducible: Always Have you reached out to the Fedora Reproducible Builds folks about this? This is the first time I'm hearing of this.
Very few artifacts shipped in Fedora is gzipped I think so it's not a problem for distribution as such, however having a deterministic zip command available in distro is important for several use cases.
Is this the same issue or something else? https://github.com/zlib-ng/zlib-ng/pull/2102 - Make deflate output deterministic if PREFIX3(stream) is reused after deflateReset
Non-deterministic compression would be very bad. I hope it's just the above bug which is already resolved.
Sorry, believe they are deterministic but not stable from release to release: https://github.com/zlib-ng/zlib-ng/issues/2216