Today on Out of Frame, I'm going to talk about Luc Besson's new $200 million blockbuster, Valerian and the City of a Thousand Planets, or, more accurately, the fantastic and highly influential French graphic novel series that it's based on. For those of you who aren't familiar with Besson, he's had an immensely successful career that started with creating an entirely new genre of filmmaking in the 1980s called Cinema du Luc, with films like La Femme Niquita, Subway, and Le Grand Bleu. Then he saw American critical acclaim with Leon the Professional, and eventually enormous commercial success in the sci-fi genre with The Fifth Element, which actually featured production designed by Valerian and Loreline artist Jean-Claude Meisier. Valerian and the City of a Thousand Planets is a project that Luc Besson has reportedly been trying to make for decades, and he's hardly the only filmmaker to be influenced by Valerian and Loreline. Even though the comics by Pierre Coustein are largely unknown to American audiences today, if you know where to look, it's hard not to spot their massive impact on the history of science fiction cinema, going all the way back to classics like Star Wars and Barbarella. But what I like most about Valerian isn't the creativity and humor of its characters, the originality of its alien worlds, or even its inventive bold artwork. Nope, what I really love about Valerian are its ideas. But before I get to that, we should talk about storytelling for a second. This may come as a surprise to a lot of people, but big ideas about society and philosophy are actually pretty hard to successfully incorporate into creative stories. In his book Three Uses of the Knife, playwright David Mamet said that the best dramatic stories stick with you, because there's something in them that comes from the heart, and so goes to the heart. By contrast, Mamet says that what comes from the head is perceived by the audience, the child, the electorate, as manipulative. And we may succumb to the manipulative for a moment, because it makes us feel good, decide with the powerful, but finally we understand we're being manipulated, and we resent it. The point is, stating an idea outright, or simply presenting the evidence for a particular viewpoint usually winds up making audiences feel like they're being told what to think or to feel. And let's be honest, nobody likes that. As a result, writers pushing a particular message often end up creating preachy stories that are boring, divisive, or just plain irritating to the reader. Meanwhile, perhaps ironically, stories that are centered around relatable characters usually end up conveying their ideas much more effectively, whether the author has an agenda or not, because the audience organically empathizes with characters and the situations they find themselves in. Political scientists like Brendan Nyan and Jason Reifler call the tendency for people to reject direct evidence that challenges their pre-existing viewpoints, the backfire effect. While psychologist Marcus Applesworth suggests that people who empathize with characters in a story experience something called narrative transportation and become more open to those characters' values and ideas. Another way to think about this is that it's easy to disagree with an abstract or intellectual idea, and it's even easier to dismiss evidence you don't like about the real world. It's almost impossible to disagree with someone else's experience, and in order to enjoy narrative fiction you have to suspend disbelief, at least for a little while. All that is to say, for those of us who do make films about big ideas and intellectual concepts simply presenting the facts isn't persuasive. The only way to make new ideas compelling to most people is through the use of a storytelling technique called allegory, or a symbolic narrative using concrete characters and situations to represent abstract concepts. And few genres offer writers a better opportunity to talk about philosophical ideas through allegory than science fiction and fantasy. Valerian and Loreline is a perfect example of this. On the surface, it's one of the most wildly inventive and original comics I've ever read. It's set hundreds of years into the future where humans have survived a nuclear holocaust to eventually learn to bend time and space, and our heroes are a pair of fearless agents for Earth's spatiotemporal agency who travel through the universe encountering new civilizations. Valerian is fun, but a bit arrogant, yet genuinely skilled as a space pilot and operative. Valerian is smarter and a bit sarcastic, often bailing Valerian out from situations he can't handle. They make a great team, and their adventures are exciting and fun to read, but underneath all that are a set of ideas about how society should work. For example, in Valerian and Loreline and The Empire of a Thousand Planets, the book that it seems like Besson's film is mostly going to be based on, Valerian and Loreline are dispatched to the planet Sierta, which no Earthling has ever visited. The planet is described as the greatest market of the empire, a hub of trade and peaceful commerce from merchants from across the galaxy, where one can find virtually anything they could want or need. What's more, it's a spaceport that welcomed ships from all over the solar system. There's no customs, no security, one comes to Sierta the Magnificent unrestrained and leaves it freely. This isn't a dystopian nightmare like you would see in so many other depictions of the future, especially on a world dominated by commerce. Valerian and Loreline mainly depicts commerce and trade as it actually is, the opposite of violence. Pause for a second to think about how rare that is, since at least the 1960s, businessman has been the most reliably predictable villain in pop culture entertainment. But eventually, when Valerian and Loreline learn that a religious sect has taken over the government of Sierta, restricting trade and immigration, creating a secretive ruling class that impoverishes the people of the planet, they work with the leader of the merchant's guild to overthrow the government and reestablish free trade and commerce throughout the system and even build new trading relationships with Earth. A lot of Valerian novels have similar themes of peace, trade and individualism. In Heroes of the Equinox, Valerian becomes a champion competing for the honor of becoming the genetic progenitor of the next generation of an entire species on a planet called Simlane. I know, it's a weird concept, but welcome to science fiction. Anyway, after a rigorous series of physical challenges, the final test requires each of the challengers to describe their ideal vision for the future of the planet. First, Ermgol says that he would see Simlane build powerful spaceships to conquer the galaxy. The next challenger, Ortsog says that he would tear down all symbols of wealth and luxury and institute a communist central bureaucracy to plan society, redistribute wealth and rebuild Simlane into an agrarian and industrial world. Glimphlim speaks next, advocating a society that renounces technology and industry and allows nature to reclaim their cities, leaving the future generation to live in the wild like their ancestors did. But finally, Valerian arrives. Unlike the other challengers, he's caught off guard by the very idea of the question. He says, honestly, I don't really have a clear idea. Anyways, it's not up to me to define it. I hope the people will be happy in their own fashion on their planet. Throughout the entire series, Valerian and Loreline fight on the side of individual self-determination and the value of a diverse, peaceful, prosperous society. And they do all this inside the context of entertaining and original science fiction storytelling. Which means that all of these ideas about how our world could and should be are felt and seen by audiences, instead of being presented as argument to be dismissed or ignored. I have no idea if these kinds of ideas will make an appearance in Luc Besson's new film, but I hope so. If his treatment is as smart, vibrant, and fun as the source material, the film should be pretty good. But hey, if not, you can always go read the books. Hey everybody, thanks for watching this episode of Out of Frame. If you want to see more video essays like this that talk about art, culture, and cool ideas, subscribe to this channel and check us out as at fee online on all the social media.


a woman that I'm attracted to, I like indirect stuff like going up to woman and get yourself relatively close, don't approach straight walking in. That's a sign of aggression in primates. You walk straight up, stare in the eyes. So I like to kind of talk over the shoulder and say something more like, can you solve a argument I have with my best friend today? Is it better to be wanted or needed? And why? Beautiful women are accustomed to being approached around beauty. So talk about the mind. Show that you're more than just a dude that's looking at their superficial.


Sutton, the other co-principal here at Randolph Union, and we wanted to have this forum tonight to sort of help shape our work for next year. Last school year, feels like a long time ago, we went through some mission and vision work facilitated by the Vermont School Board's Association, so we were asked to do some strategic planning and get some information about priorities, and we did that at the district level, but what we really want to think about is what that might look like in our school context and how we can incorporate families and helping us to shape that vision, and really finding ways to include families more. So this is our first forum and jump into that world so that hopefully we can structure our family engagement really thoughtfully next fall. So we plan this agenda to jump right into that work, and I'm going to hand things over to my co-roller rolling fellow from 2015. We focused a lot on advisory and facilitation, and Angela Vauer will take things from here. She's also at the 9th grade English teacher. Thank you. Can you believe it's been that long? No. So a while. But it was such a good time. I'm Angela Vauer. I teach 9th grade English. I also have taught 7th grade English here as well, and advisory is a really important part of the work that I do, and I feel like the work that Lisa and I did in 2015 as rolling fellows really helped bring our school community together. We talked a lot about adult advisory and making connections, and when the adults in the building feel connected and can communicate well, we're just so much better for our students. So that was a really important part of our work. Part of that work led us to bring people together in a circle, and just the power of that shape as you, as my students here know. And I should acknowledge you guys too. Thank you so much for coming. We have some student voices here tonight when we heard Family Forum, and we're talking about what our vision is for the future. It's like, we should invite everybody and get some student voice in here too. So thank you so much for coming tonight. I appreciate you. So we're gonna start tonight with what's called a wagon wheel. Do you want to explain it? No? Okay. And we didn't know how many people we would have. So we're gonna adjust, adjust a little bit to the number of people. Are you willing to participate in our circle? Sure. Would you like to participate in our circle? Sorry. Would you like to participate in the circle? No, I'd better be more objective than on the outside. Okay. I just wanted to invite you if you wanted to be part of it. Okay. So I will participate as well as facilitate. So we are going to do a wagon wheel kind of process to think about where we are in our work, in our school right now. So here's the exciting part. Get up, stand up, and find a partner. Usually I have kids stand up, partner, and then you high five, and that's how I know visually that everybody has a partner. Thank you for going. I think you're going to have to stay standing. Sorry for that lack of clarity. So you have your partner. Now with your partner, I was going to make a suggestion that we have ice cream for everybody at the end of the night. That can't happen.   Okay. So keep in mind who is vanilla and who has the chocolate. Okay. And I'm going to hand out an excerpt. Actually from a sermon from a Unitarian minister in Massachusetts, did everybody get one? My old brandy reading spectacles in my classroom, so I'll do my best. You want mine? Thank you. If I stumble, I might like throw it over to you. It's called, and how are the children? Among the most accomplished and fabled tribes of Africa, no tribe was considered to have warriors more fearsome or more intelligent than the mighty Maasai. It is perhaps surprising then to learn the traditional greeting that passed between Maasai warriors. Kassir and Ngera, one would always say to another. It means, and how are the children? It is still the traditional greeting among the Maasai, acknowledging the high value that the Maasai always plays on their children's well-being. Even warriors with no children of their own would always give the traditional answer, all the children are well. Meaning of course that peace and safety prevail. The priorities of protecting the young, the powerless, are in place. That Maasai people have not forgotten the reason for being. It's proper function and responsibilities. All the children are well. Means that life is good. It means that the daily struggle of existence, even among poor people, do not preclude proper caring for its young. I wonder how it might affect our consciousness of our own children's welfare. If in our own culture we took to greeting each other with the same daily question, and how are the children? I wonder if we heard that question and passed it along to each other a dozen times a day. If it would begin to make a difference in the reality of how children are thought of, cared for in this community. I wonder if every adult among us, parent and non-parent alike, felt an equal weight for the daily care and protection of all the children in our town, in our state, in our country. I wonder if we could truly stay, say without hesitation, the children are well. Yes, all the children are well. What would it be like if the president began every press conference, every public appearance, by answering the question, and how are the children, Mr. President? If every governor of every state had to answer the same question at every press conference, and how are the children, Governor, are they well? Wouldn't it be interesting to hear their answers? So I'm going to ask you now those who have the vanilla ice cream, to form a small circle. Yes, you already know. So form the circle first, because people who don't know it well, okay, so they're from your circle. Yes, kind of a tight-knit circle. And then you're going to turn your backs to each other. And those of you who are partners on the chocolate side are going to stand facing your partner. Well, we're going to do a minute repeat. Let's start with the minutes and see how it goes. Okay, we need to shrink it. Sometimes you need to adjust it really. Okay, so this is what we call a wagging meal activity. My class, are you okay? Yeah. Okay, is this more good than you bargained for? Yes. Okay, a little risk, but risk nonetheless. I understand. You're best, okay. Okay. So in this wagging meal, those on the inside, I would like you to start responding to this prompt. We're going to have one at each. And those on the outside are just listening. I encourage you to respond with body language that is encouraging, nodding, showing that you're listening. But really, your job on the outside is just to listen. And the goal of the person on the inside is just to keep talking for the whole minute, which pushes you sometimes to keep going with other things that maybe you didn't even know you had in you that you were going to say. So thinking first about that, that excerpt. On a scale of one to ten, one, meaning the children are in danger. And ten, meaning they're well and they're thriving. Rate how the children are doing in the school and the community. You can think about it outside of the school if you want to. And why? So on a scale of one to ten, what is your number and why? In one minute, inside circle, begin. Five, three, four, five, six, seven, eight, nine, ten. Well, again, it's hard to tell who's who because I don't know. Things with problems come up. But I think that I mean that's I think there's a lot within the school that's very much in terms of isolation. Um I guess it's really depends on who's every single thing. I don't think there's a lot. I think there's a lot of you know, I think it's So we'll do one more one minute now for the outside circle to respond to that feel like it was pushing just enough. Okay so one minute for the outside circle to respond to that same question what would your rating be? 1 through 10 on how are the children? 1 through 10 on how are the children? 1 through 10 on how are the children? Okay here's where it gets exciting. So everybody in the inside circle could move one person to the left please. Okay so for this round I'm feeling like one minute feels pretty good. I was just feeling like I'm going to have to think of something else. Okay so for this round the outside circle would start first and I want you to think about what is one thing in our school that our school community a random community to do to shift that number that you have in your mind like where we're at closer to 10. So what's one thing our school community to do to shift the number closer to 10? Okay so for this round I'm feeling like I'm going to have to think of something else. I'm going to have to think of something else. Okay so for this round I'm feeling like I'm going to have to think of something else. I'm going to have to think of something else. Okay so same question for the inner circle. What could our RU community do to move that number closer to 10? Okay so for this round I'm feeling like I'm going to have to think of something else. Okay so outside circles turn to move to places to the left. Okay so now the inside circle will start this time. Again you have one minute to respond to that next question. What's one thing you could do personally to help shift this number closer to 10? Okay so for this round I'm feeling like I'm going to have to think of something else. Okay so for this round I'm feeling like I'm going to have to think of something else. Okay same question outside circle one thing you could personally do to shift this number closer to 10? Okay so for this round I'm feeling like I'm going to have to think of something else. Okay so for this round I'm feeling like I'm going to have to think of something else. Okay so for this round I'm feeling like I'm going to have to think of something else. I think we're doing okay. Okay so let's move the inner circle one to the left. Just one minute so outer circle starts first this time. If you were to put yourself in our students shoes what is one thing you would like to see change in the school experience? Okay so for this round I'm feeling like I'm going to have to think of something else. I'm feeling like I'm going to have to think of something else. Okay so for this round I'm feeling like I'm going to have to think of something else. I'm feeling like I'm going to have to think of something else. Okay so for this round I'm feeling like I'm going to have to think of something else. Alright nice job next group. Thank you for the timing I appreciate you. Same question again sorry. In my education I think I want to be allowed to critically think to get like different ideas that flood into me. And then to have time to think about those different ideas and exchange ideas with other children. And possibly have debates and do research on topics so that things to me as an individual that I can use myself. And of course I think I should be as a grow older and try to become your colleague. Thank you for sharing this wagon meal experience. I'm thinking for I loved here like one of the downfalls of the wagon meal is that we didn't get to talk. And we don't all get to hear everybody's voices. I'm wondering if it would be possible for us to just make a big circle with our chairs. And just do a quick debrief would that be okay? Yes. I know I am everywhere. So often in our advisory circles or when we run a circle we use a talking piece. I think there's a lot of resistance to a talking piece at first because it feels really, I don't know what adjectives would be. It feels pretty preschool. I was pretty anti-talking piece when we started advisory training but I've been converted so. Me too. And I didn't bring it on because I didn't think it would be. I wasn't sure what our numbers would be or how useful it would be but it's important to share. I mean to those of you in the community who maybe don't know. It's a really important tool to help honor one voice at a time. So the talking piece is something that you typically hold and only the person with the talking piece is speaking at that point. And even kids and you always have the option to pass. And when you pass the beauty of the talking piece I think is when you're holding it everybody is still noticing you. And noticing that you are part of the circle and part of what's happening here and so that can be really important. So I'm just going to hand in a imaginary talking piece I guess today because I didn't think anything about that. But I'm curious in terms of a debrief wondering what you noticed about that live and real experience. Can I go to you first? Would you feel comfortable? Some people I talked to felt the same way about getting like parents and just the community in general more interactive with the school because I feel like having because we only have certain things that we do like a senior project night and like a science thing or something. I feel like doing stuff like that more like would help bring people together because people seeing what you go to school for and not just like oh my kid goes to school is like a lot different because they can actually see what you learn. It means a lot when you like your parents come in and look at all the progress you've done. And I feel like if they don't pay attention to what you do then you start slipping something away. And like your grades get bad and stuff like that happens. So I feel like we were just more interactive if it would be better for us. I feel as though like if students and teachers were more commutative. Yeah and so to each other it would be easier for us to like be able to get down in our heads like this is the word. Like this is what we expected of us. Instead of like I know at the beginning of the year things just like pushed onto us because it was right out of COVID and we were all like in a rush to be able to get the year normal. And I feel like us being more whatever you communicative that is better for us to understand both ways. Like you get or if we talk to you about like getting an expansion or like needing more time and some kids just take longer and it's easier for us to communicate with that with the teacher. So the teacher knows and like on good terms for our school community. So I think one of my points during the wagon meal is not only mine as well is that I heard a lot about more positivity. And I don't believe that there isn't any positivity and it's not what I'm saying at all but I feel like there can always be more. And I was mentioning uplifting events, you know, Feb rallies. I'm a big supporter of Feb rallies because I feel like it brings more people out to sports events and it probably makes people more aware about what's going on in the community and what it probably makes them a joy to be at school more often. But I feel like anything we can do to, you know, involving the community. I was talking about that as well as I believe is very important.  And maybe there would be less confusion and less, I really cannot think of the word less. I guess less confusion in the household when it comes to, you know, say this person just there saying how the grades are going down. Well, maybe it is a topic that the student is not very familiar about or something. Or basically that where if the parents are able to see, you know, that maybe the student did put out a great piece of work and, you know, they've received a great grade for it. Then the parents themselves get to see, you know, oh wow, you know, my student is doing really well. One of the things that this reminded me particularly when I talked to Jessie, she was talking about positivity and events like a couple of weeks ago we had a basketball tournament and brought everybody together and everyone was really cheering and it was very positive. But also that made me think about Greenup Day, which the middle school did and the high school didn't. But it was so kids really felt strongly that they were doing something good for the community. And it reminded me of some of the PBL work that we had done project-based learning work that we did pre-COVID that required strong communication skills, executive function like planning and prioritizing and some of the work that we did in the community and how good people felt when they were helping other people who needed genuine help so it wasn't something that we made up as an activity for people to practice those skills but it was real and it was something that engaged people and was really positive and I'm looking forward to more of that kind of work. I just, I appreciate this because I really appreciate the written piece and thinking, you know, and how are the children as our focus here and that sometimes we deviate from that focus and deviate from this idea of like the last prompt asked us to do looking at the school through the eyes of the students. So Angelina and I talked about like how we amplify student voice and I was talking to you, Angela, about how much, how creative and flexible and versatile we've had to be throughout the pandemic and what that has taught me anyway is that we have to listen to students more about the ways in which they want to approach learning and honor the things that you all do outside of school too and validate that as learning and find ways to capture that and give even more agency and choice and voice to students who really are the ones who have even more agency than they think to carve out what the culture and climate of this school should be. So, to me, and I apologize, Tape, I'm actually taking that idea as people are talking because it allows me to kind of process that stuff a little bit later. But same thing in Angelina kind of plays on a theme that she had started that this idea of finding ways to establish a lot stronger links between the students kind of amongst themselves so that they're creating their own safety net. You know, if those relationships are stronger looking out for one another they're the ones that know if somebody is struggling and hasn't gotten help and can come and talk with a trusted adult because I connect them up with the help that they need. But also, as part of kind of trying to get those folks connected starting off with a really strong peer mentoring program so that when the kids are transitioning up, especially from middle school we put them with an awesome senior, an awesome junior so they've got a couple of faces that can show them the ropes that can work with them on any of the problems that they might be encountering and the struggles that they might encounter as they work with them in school. But also, by along with what Lisa said on the idea of the service piece is that one of the new traditions could be we do or enter into the presidential community service boards. So it's a volunteer program with students that put in certain levels of hours with the bronze, the silver, and the gold. Not only is it good job and connected with the community and doing some great things, but it's also really good in your resume anyway. It's just some ideas that are coming through. I started the wagon wheel thinking about how families and parents can come into the building more often and be more involved because I think the kids see that they value their own work. So I want kids, my own and their friends to know that we think it's important and it is important and I want to, they don't always share everything there. So, like Evan said, they might tell me what they're doing but 90% of the time they don't even tell me what they're doing. They'll pry it out of them and they still don't know fully what they've learned in that lesson plan. So coming in on a more regular basis would be great for me. I love coming to sporting events but I would love coming to three or four nights a year just on science or just on math or just on other courses to learn, have a relationship with that teacher a little bit and see what the other students are doing too. What I got out of the wagon wheel, especially from the younger students here today is how much important it is to schedule more fun. And Lisa did a really good job of just explaining the important skill sets you learn from all that but I mean just making it fun is important too because then Angelina would be getting those relationships with teachers and the safety nets. And I think it's okay to just schedule fun with someone. I know we have a lot of things that get done but they'll get done better if we're all having fun along the way. I think there was a common theme even though we didn't all talk to each other.  We called it more community involvement over here but we were basically talking about the same thing. You know, encouraging parents to understand what's going on in school and creating a line of communication between students and adults so that they know what's going on in school. Me personally, I like to integrate into a classroom once in a while and just see what's being taught, how students are interacting with each other, how students are interacting with teachers. I also think that this would be a really good idea for students and maybe if we started it in small groups in classrooms and then expanded it through advertising from the students through to the parents saying, hey, this is going to be a much bigger event on this evening and we got together 10 small groups like this and then threw us all in the auditorium or whatever next door and had this type of conversation and I think it could really grow the school way beyond what the 10 of us can do. But yeah, I think maybe you do this in small groups in the school to kind of build it up so there's more student involvement. I mean, there's 600 kids and we have three so we've got to get more of them involved and we've got two parents and we've got to get more of them. I would say a lot of what he said and this is why I think it's amazing. We don't have this down problem and I'm definitely going to talk about this. I do like the thought of being able as a parent to come to a school and shadow a class for a day and don't talk to me, I won't talk but I'm just going to sit and observe and see how things go in a classroom between the teachers and the students and that also might strike up a conversation of how I can help my student make it better in the classroom, not just with her teacher or the principal with another student just from things that I'm able to observe as just on the watching. Definitely want the kids to have a safe space to have discussions on why they make. My important thing is for kids to be able to make sure they're in a safe space to have their disagreements respectively and that's another important thing I could make kids happy. I would echo a lot of what's been said I think to John's point, prior to the pandemic we had a lot of circles. We functioned this way a lot. I use the wagon mail a lot in my classroom because it doesn't bite that communication but even though you're not talking to everybody you do get a sense of like what's the vibe in the room or what's our culture. So we do use that a lot. I think we could expand it for sure and I think particularly among the adults and having the adult and young people conversations I think we could do more of. What I always notice is it's time to reinvigorate advisory that really helped create relationships and perpetuate those interpersonal relationships in a way that kids felt safe and knew who they could go to they knew who to go to a peer was talking about the safety net they knew who they could trust to talk with other people about just keeping people safe and keeping people buoyant. I appreciate David your conversation I feel like in our first pandemic year back that was so different from any other year that I found in my 15 years of teaching like played a lot of kickball and we played a lot of grammar and kickball so I could pull in so we're still out there we're still talking about grammar but we're still having fun so I appreciate that but I think when you guys on the days when we have fun you're more engaged in the learning you're like wow that went fast or we got through that lesson and we really just thought we were having fun and hanging out so I appreciate that feedback I think the more we can encourage teachers with some pressure on a teacher to justify that fun that use of fun time and I think if we can eliminate that a little bit and demonstrate how having fun together helps us create bonds and relationships that are way more important than how to use a semi-colon Yes, I just didn't want to add it to this So I feel like parents tend to look at bad grades that a kid has I don't know obviously every parent is different but I just feel like involving people more in what you do every day because one bad grade doesn't reflect how you are as a student or a person and it just feels like the more interactive we are the better it will be I think adding the fun days and sometimes we go outside and have science class outside helps you want to be there like want to be interactive in school So thank you you kind of whispered in can I go again? So I'm just going to send it around again if there are any last thoughts that anybody can share or you can add to anything I definitely feel like right now we are adding English with the Innovation Center it's like super fun because we had the whole book and the journal and the credits and the whole we had to do the prompts for the reading but adding that Innovation Center into it made it really fun to actually be able to pick it in a roll and have to print it out of them machine, elixir family but like adding the fun definitely it helps in like hands on things help us learn more I feel as though I'm a hands on learner I love hands on things it's like it actually clicks in my brain to be like oh yeah like that actually makes sense but I don't think we're at right now we should we're at our school should focus on a lot I'm wondering students, leaders how can we how we can increase student leadership and I will use an example so I think that so I do announcements currently and I get you know five people every Thursday coming up you know say great job great job so I'm wondering how creative we can get with it so Miss Allard down at the tech center asked me to do ghost TV next year so that is my example in saying like how can we have students increase the energy of others how can we have students bring up you know enlighten the mood and how can we have students become leaders and that's all I have to say student leadership is something I have to advocate for I'm going to pass I'm enjoying hearing all of you I'm enjoying hearing all of you too and at the risk of sounding like a cliched educator learning should be fun so it heartens me to hear from all of you about ways that it could be more fun and what you're you know what you're it's just it's leading me to think a lot about the input we could be gathering from all of you about the directions we should be moving in as far as what does make learning more fun what are their opportunities for you all to do as leaders in the school that would feel really good more of a question than a statement as in trying to figure things out as folks are talking in terms of the beneficial things that were presented what is the current state I mean do they exist now in some form are they here are they here are they here are they just don't exist I don't know I don't know what are you going to do on ghost TV you can't answer that you can only interview students can't answer that yet I'm interested to see that I think that could be great so I have another oh you want to go again I think they want to open it up so I can answer the question okay so no and that's great so I love that you want to respond and also if I think we talked a little bit it kind of came up naturally as to why we would do something like this in a meeting or in a classroom like it just invites this kind of authentic dialogue so you can go around again you can respond to questions or comments that you could and let's just suspend the talking piece that we didn't actually have and give it a more free form dialogue and so anything that bubbles up we'll just see how it goes and we'll just keep an eye on time so that we can move on to the next so about 10 minutes or so depending on how good it is I was going to say your appreciation really helps out because when a teacher comments on like a piece of work that you've done or like how well you've been doing like it really means a lot I think it was Ms. Bauer at the beginning of the year that sent out note cards to every kid just telling them what they've been doing good like everything and I understand like a teacher's job is probably pretty hard and stressful but like it's hard and stressful too so little things like that that like teachers do as pick-me-ups are like really impactful on like how you do your school and like it makes you want to get that recognition that you kind of deserve for doing it I definitely feel like parents do focus on your bad grades more than they focus on the good grades and I feel like when a teacher does what you did really well on that piece of work you have then like when you do bad it's usually like you could but like it's like you could put it more in a positive way and be like there's so many things that you could fix on this and it could be so great and like I'll help you out I can have that connection as to where the students feel that they can go to you and be like I need your help and then have that help or as like the teacher or some teachers can be like well you've had all this time I'm sorry to interrupt then would you share your question that's exactly I was just about to ask the thing that was coming to mind is people were talking there were a lot of good things that were mentioned there should be more of them so their basic question is do those things exist now at what level do they exist is it a lot is it enough is it really poor where is it at so try to think about how to make this so that they don't have to go over each specific thing that they talked about if we're talking about say things that you know say uplifting things I would say that there's no doubt that it does happen it happens probably not enough that is my opinion as well I feel like there definitely could be more of going back again to like pep rallies or things to just involve the students more you know something to distract them for lack of better word from say the hardships that and so I would say yes there are great and positive things that happen absolutely could there be more absolutely but you know you don't want to bring it to the level where there's no learning being done and so obviously there are many more discussions about how to you know kind of generalize that down into a specific area of how many things happen per year so to speak my answer do you have any other questions I kind of want to just about all of you okay Evan's right I don't want to go to the extreme when there is no learning but I was thinking once a month we could do a pep rally get the whole school community together and have the time to actually put our school into thought and be like oh well this is what has happened this month and this is what our school is doing this is what we can do to have fun for this day and like take a break from all the hard work you guys have done I'm just taking the mind how hard students actually work and how hard students teach us I wonder if that looks like a pep rally once a month seems like a lot of pep rally three a year but I wonder about like a community meeting if we came together we had thoughtful dialogue and acknowledgement of what's been going on in the last month we can't do a celebration of learning every month that dilutes the joy of the celebration of learning at the end of the year but I think we could come together either at grade level or like we could find some way I think to honor the hard work that everybody's doing and I appreciate that you included teachers in that as well and just have some way to connect and communicate and kind of just check in with like how are the children right now and then acknowledge like what can we do better and what could we shift if we need to in those community meetings I know sometimes community meetings in a school can feel like here as a teacher running this community meeting but then speaking to the student leadership it would be great if every grade level took a month or each advisory had an opportunity to host something that they planned I feel like we could lean in on you guys way more and take the burden off of some other some other teachers to like what do you want to celebrate and what does that look like so I really appreciate you bringing that up I think like more community partnerships too would be a really cool thing to do partnering with the food shelf or just something that we could all put effort into would be really cool because including everyone even if they don't have kids that go to the school or it would just make it a better environment to know that people care about your well-being at school I think just doing more outside of the school for it No I just want to try to think back the seventh grade here try to do we have full I feel like we have full seventh grade medians we did we have so that you were a seventh grader like the year that we stopped right? and we used to I think once a month do a grade level community meeting and we would all go I think we'd do like a meeting in the gyms or different grade levels had different places we always went to the classrooms with the diviners and just all went out all right that would be a good thing absolutely yeah that would be great to bring back I think last year the eighth grade team sort of held on to that a little didn't you guys do more meetings and recognition like outside last year sometimes not a full we did a class well so that was hybrid so it was half the eighth grade on one day and we did half the next day so it didn't feel as big what happened when you were seventh graders I have a question this Floyd and I have talked about this quite a bit so Jessie what you said just reminded me of it we've thought before like how great it would be if we identify some community partnerships like that like the food shelf or the veterans home in Northfield or you know some different organizations we could work with and actually like assign an advisory to work with them and to you know that would be your community partner service with throughout the year and then we could have competitions for you know which advisories put more time into their work with these organizations and I don't know we've talked about that a lot and I just wonder what you all or the group could choose their own partner a long time ago there's a lot of like small farms around here too like breaking crops and being able to like have a farmer's market or something like at school would be something super cool community garden drive for the youth you know he and I we are just about out of the time as the time keeper yes thank you you're welcome I just wanted to say how like I feel if we did reflection very true cover again while walking the glass photograph what happened last night does anyone want to chime in before we shift gears to our next do you want me to keep here okay so the infinity map and usually you do it up on a wall and that's why I'm sorry like fully evaded your space and I was like why that weird one spot of all things I actually think given the size that it makes sense to just put the paper down on the table and we'll just map it there does that make sense but I was going to put the paper down just in case you want to say what we could roll it up instead of trying to like deal with all this great on a surface okay so I'm going to let me give you the prompt first so you can think about it now since the ease onto this table right behind John so one of the things that seemed to work really well when Lisa and I were rolling fellows and thinking about like some major school transformation and it was focused on advisory at the time but I think it's applicable to any kind of like revisiting your school culture and climate and how do we kind of like reset or you know how do we move on from here in a more positive way I think it can be really helpful to focus on our bright spots like the things that go really well and often in education we hear like asset based you know that word asset like oh yeah let's do let's focus on our assets and I think there's a difference between our bright spots and our assets like we have some strengths as a school that you might be like there's an asset but what I like you to think about right now is both like as community members and students and educators like where are the bright spots like what makes you smile what brings you joy like when your kids come home like what do they share that they're happy about there are certain strengths that we have like a school can have a strong music program and that can be an asset or we could have a strong tech team that's flawless or you know there are things that are assets that we can think about like yeah that works well for the school but I think in starting off rethinking what our culture feels like within the school is like kind of what you were saying like what brings us joy what makes you happy so I'm going to put some paper down and there are lots of sticky notes and pens and pens and so what I'm going to ask people to do once I have this paper down on the table is just on on each sticky note you guys are familiar with this process too like just how many bright spots can you think of just one on each sticky note what are the bright spots when you think about our school and you think about what happens to your kids at school or what they experience or what you experience like what are the bright spots okay so thinking about bright spots and all we're going to do this paper down and then we're going to put it on this bigger in your pen yep and you're going to because we're going to move them later so there's a reason that we're not writing right on there I'm just going to watch this part of it and I'm going to take these three students here we're brainstorming how we can make it work I think we have a teacher on that he's a teacher okay so typically we're sure how many people we would have what's on the stickies and start to create groups of things that feel similar that they fit in and it's okay if you silently move one to one spot and somebody else moves it to a different spot your scissors or hard feelings about the moving of the sticky notes but we'll just notice as we kind of walk around and start moving the sticky notes into groups where are the categories that are bright spots look, wander around and move the stickies that you feel like fit together my question and the question that I always ask my students and he would love it for those of you who don't know Cara Merrill our school counselor pretty much makes anyone around her get into a pyramid any of them like cheerleaders and it's very joyful because it's impromptu first you're like what you want me to so we just had the senior trip and we got sent to pyramid of the senior trip on each yeah one thing I'm noticing is the relationships and the learning and how all of that is mixed together which makes me wonder if Cara's pyramids should be over here by aha moment things because I think it is so relationship based I wouldn't be a part of a pyramid for anybody I didn't really care about or trust right that's true yeah especially if you're up higher yeah what I heard in the circle and I see here is a strong desire for kids to have interpersonal relationships connectivity with other people whether it be in the school or in the community I mean that's what all of this is here to some extent that's what this is here and so this is here it's and I think that's a after effect to cope it there's a lot of isolation you know remote learning kids didn't get together like they did and I just as humans I think we just desire to interact with one another and that was taken away for here and I hear them loud and clear saying that in many different ways and I think I see it on this table too that that's a bright spot for them if they can get back to that and really strengthen that in the future dedicated teachers I see a couple about teachers but having teachers that actually care and that you can have like a separate kind of relationship with other than just here's work and do it like actually talking to your students makes me want to be there when there's a teacher that doesn't have a desire to feel like they want to be in the classroom that just brings the whole classroom down and makes them not want to be there either so just involving yourself with people's lives makes a big difference and sorting out through all those student nominations for teacher awards that takes me a really long time because I've been reading every bit of the group of form that's really inspiring you're looking at me like I have something to say you're not obligated I just like so many people put down stuff about music so that's what I'm happy about always being in class is actually really fun I'm in the mindfulness and movement class and we do a lot of like hands on we're doing the whole YouTube and Instagram, TikTok thing right now it's really fun but it's also like really it gets your brain working like what are we doing in our school community or anybody around us in our community will like and actually take a deep breath from I like PBL's a lot too, I take a food systems PBL which also includes an English graduate because we like write what stuff it means to us and stuff like that and just PBL's in general because when you're in 9th grade you don't get mixed with a lot of other grades first aid but in PBL's my food systems PBL I have 12th graders, 11th graders all high schools and just people that I don't usually get to see and it definitely helps and puts me out there more stuff that I can usually do that's a really good point it kind of pushes you to take those healthy risks that's kind of what was resonating with me too like when you were talking about innovation center and you were talking about bringing joy and like those fun moments like they don't have to be in isolation like we could be like I'm watching interactions in the innovation center where people are helping each other and they're still laughing over something that happened you know you still have that social piece that connects you and I think that our PBL's and our ILO's to some extent provide that opportunity for you to feel that human connection still be productive and hitting learning targets and demonstrating your proficiency in areas but you're having fun during that time like we did this activity now Mrs. Bowers didn't make me write about it but some of you have already said did you say I have what was the word you use I think it was an astronomical amount to write about because she did something that was just today yeah and I just think that's so cool that's what is resonating with me right now like how do we put more music like the music is awesome like it brings us joy how do we bring that into our everyday more often it is we might have to throw a pyramid right in front of us we start our morning with it yeah so what other ways can we like maintain a good vibe after the morning music is over and you've moved into your classrooms like today watching 9th graders move from RTCC which was really a great experience to just go check everything out and the feeling when we moved back to classrooms was like now we have to go back to sit in the chair and do what we have to do which fortunately wasn't your circumstances but there was a definite vibe of like what can we do how can we emulate the things that are successful and more hands on student propelled and I'm hearing all of you reflect on this positive experience in the innovation center and I'm wondering if that translates into like we're going to offer intro to engineering out of that space and we're going to offer innovation management out of that space and other classes do you feel like your experience in building games last year and then this year going down there helps you think about yourself in that setting whether or not you see yourself as someone who would want to work with all of that technology usually I think things like that where we actually do hands on stuff pushes you I wouldn't usually pick out an animal to describe myself so just different projects like that push you to think more about who you are what you want to be what you want to do I just think it means a lot yeah it's a different way of reflecting I can say open to the next blood page from your writer's term everybody goes it feels good to talk about yourself not even the noise it's just like the feeling in the room singing but when I like hey tell us about your animal everybody's like is there something that I did that I created that I'm connected to now yes I want to talk about it just finding more ways to lift you up in all of the like you have to hit the performance indicators but how do you do them while you're feeling lifted up as opposed to feeling here we go the peer paragraph research paper research paper well the thing is I get that you have to do that stuff and the editing is good it's good practice to do that stuff but not all the time I just want to say something about the ILOs because I think those are great for people who like to work independently like myself I take ILO PE and so I'm always outside when I'm at home doing stuff and working on stuff and so I enjoy kind of the independence of that I don't know if I would take another course as an ILO only because I feel like ILO PE is way different than any other because other course you have to study for you know do homework even though you know exercise is your homework for ILO PE but I just enjoy ILOs having that and do you have a journal for your PE ILO? I do I do every week and read some articles I don't even have to do the articles but no what I do is I just I go do whatever I do at home and I just write about it and check and then ILO looks different in every content here but that's why it's an independent learning opportunity it's tailored to you and what your needs are and how we can fulfill your graduation requirements and still I think I think we can should we come back together we're getting right down to time so maybe just giving an opportunity to ask any questions that anybody has and then we could just kind of check out the quick check out things that are bubbling up for you so just in our last little check out round again I have my imaginary talking piece that I can put down to you just like one word that's resonating with you now after this experience with our small group our first step into community and I hope just spread the word and we're going to keep talking about what can we do to be better and kind of reset after a pandemic and come back together and feel really positive and great in our school environment all of that and your experience tonight what's one word that's resonating with you right now energy joy thoughtfulness comfort interactiveness motivation hopeful communication it's now invigorating yeah I'm excited thank you all for coming for all of your thoughts and appreciate it give us ideas to springboard us and to our forums in the fall thank you thank you for your time especially in June I know right


We can introduce ourselves. We can do it ourselves. This is the microphone that's supposed to speak. Yeah. There were a couple of antennas on that access point up there. It's like six of them. So what are the slides? I just changed it for six of them, right? There they are. Are we ready? They talk on reproducible builds, on building software everywhere, not just RPMs, but all sorts of software. I'm Dennis Gilmour and this is Holger. A little bit about me. Most of you probably know who I am, so I'm not going to drown on too much, but I'm Dennis Gilmour. I have been a Fedora user since day one. I used Red Hat Linux before that. I've been involved in Fedora since Fedora.us that was building extra packages. Red Hat Linux. I am currently the platform team lead at Red Hat, so I look after release engineering for RHEL and Fedora. And that's been my day job for the last eight years is, you know, Fedora. I help make sure we get the bits out there and built and just sanity and whatnot of them. And it's Holger who introduced himself. I work on Debian. I will spare you the Debian details. Mostly I've used Fedora in 2008 or something for OIPC to build the schools over there. And I've been working on reposal builds for the last two and a half years now. I'm funded by the Linux Foundation to work on this as well. And the Stebian branding of the slides is my fault, not Dennis. The story is mostly explaining what the Debian story about this will have some outlook to do for Fedora. So, and this talk is not my work, but I'm just one person of a huge crowd of Debian people who worked on this. So, first before we start, who are you? So, who has seen a talk about reposal builds here? Some people? Who has contributed? Yay. Who uses Stebian? Yay. Maybe this question, who uses Fedora at Red? Should have been... So you're all awake, that's good. So, first a bit about the motivation of why we do this. So Free Software is great. You can share it, study it, modify it, use it, that's really cool. But we can do this with source code and we use binaries. And we need to believe that the binaries come on the source they are said to come from. There's no way to programmatically, automatically find out that this binary comes from a given source. You can maybe analyze this for one small binary, but it's manual work, so it's generally not possible. And I don't want to believe. I want to be sure, I want to know stuff. And this is what it's about. And the problems that's been causing this is explained in very much detail in this talk from two years ago at the 31st Paris Communication Congress from Mike Perry and Zed Schoen. I give some examples of what they fell there in an hour or something. So that one example of a root exploit in SSHD and there was a single bit in the binary difference and if this bit was different, it was equal or greater equal or greater, and that's a one bit binary in 500 kilobytes of binary, that's a root exploit. And so if you change one bit in a binary, you might get root. And they also had a live demo with a kernel module which modifies the source code in memory. So if you look at the source code, the source code is fine. If the compiler builds it, you get it backdoor. You cannot really be sure what's running on your machine or what you can install it and then it's probably a good system. But after it's been on the network for some time, you cannot really be sure, especially if the motivation is high. And it's also how much Fedora has a build network, Debian 2, Debian developers can do binary uploads. But even if everything is built on the build network, this build network is a great target and it's not paying you admins, it's paying your janitors, paying whoever is involved there. And if you really have motivation and money, you can compromise these systems. And there's also legal challenges. It could be forced to put in a backdoor in your system, maybe just for some customers and get a get order, you're not allowed to talk about it. So this is what we are trying to prevent. And another example was also this CIA conference that was in the Snowden paper. They had the idea to backdoor SDKs to compromise the users by going after the developers. And while this was a CIA white paper, there was Xcode Ghost, which was something found in the wild, which was a Trojan SDK for iOS, which was put on faster servers, which people in China mostly use when they wanted to build iOS applications. They downloaded the SDK from another server, which was faster but which was compromised. So there were 20 million applications which were backdoors with good source code but bad binaries. This is happening. It's not fantasy. And our solution is that we think that anybody should be able to independently verify that a given binary is coming from the source. So you should all be able to verify the same thing. And we call this reproducible builds. It's not about repeatable builds, but reproducible builds in the sense of by bit identical. So you build a package five times and you get five times the same checksum and not a different checksum. And also if you do it in two weeks or two years, you get the same checksum. And that's really it. That's all it's about to get bit by bit identical binaries. And the same with RPM, whether it's Derby and Packeters or RPM, it's the same. For RPM, there's a bit the challenge that there's a signature in the RPM. So you cannot just recreate the signature. You need to replay the signature, but that's doable. Because if you have the same binary contents, the same signature will always apply and you can get bit by bit identical containers. So what we want is that we really just do the checksum on the result and the checksum should always be the same. We don't want to analyze the contents because if you have tools which analyze the contents, these tools can be buggy and these tools can be exploited. So there should be no special tool to ignore some differences. We want really the whole thing to be the same. Everything, this should become the norm. And I... When I put this there, we want to change the meaning of free software. It's only free software when it's reproducible. And I gave this talk at the Free Software Foundation last year. I was a bit curious what they were thinking and in fact they liked it and they put now they have the Free Software Foundation as a priority list of important software projects and as part of their security priority they put reproducible builds there two weeks ago or something. So this is the Free Software Foundation basically agrees. And there's more than just security. There's lots of QA benefit. We found many, many sub-tile bugs like we built twice and then verified the results. Like we had... One example, we had different... the Python shebang line changed. Because if you build it on a fast machine below a second then the make timestamps were the same. So if you build it on a fast and the slow machine you would get different results. And we found many, many QA issues like that. So if you look... try to make your software reproducible you find a lot of other stuff which is strange and funny. Google does reproducible builds to save time, developer time and thus money. And Google made all the internal software reproducible. There's smaller deltas. So you get faster updates both for packages but also for images. Because the content changes less and so you can just reuse the data. And as a side effect you can also do a meaningful binary diff between two versions. Because if you just change one function of a huge program then only this small part of the program should change. And if there's lots of other differences from timestamps and whatever you cannot see this. But if everything stays the same you should be able to see just this function has changed. And there's probably more but these are the main other benefits. So what we've done now, since a year we have this website reproduciblebuilds.org which is... we started with having information in the Debian Wiki but at some time we wanted to have more distribution agnostic information. So this... if you take one URL from this talk then please take this URL with you. There's documentation there which has common mistake or common problems pitfalls which is making stuff reproducible. We have IRC channels with one for Debian one for general one we have mailing lists and we wrote different scope. Different scope examines differences in depth so it recursively recursively unpacks an archive or an ISO or whatever and recursively recursively goes through everything and will display that whatever RPM which has a PDF inside and the PDF has an image and the image the timestamps vary then Difascope will show you the difference. There's HTML and text output and it's available in Debian, it's in Fedora it's on FreeBSD it's quite quite widespread now. And this is how Difascope HTML output looks and the easiest to see is the lower line there with this version which is different in this example but it will also in the beginning Difascope only worked on two Debian archives but now it also works on ISOs can put it on directories can also use it to compare two different versions just try Difascope it's really, really useful and if you want but Difascope is not the tool to really see whether something is the same Difascope is for debugging if you want to compare if something is the same it should be really the same checksum Difascope is just for finding the reasons why something is not reproducible and there's also a web service tri.defascope.org where you can upload to files and have to install Difascope if you install Difascope and install all the recommands it will install on a base system about 1.5 gigabytes of binaries because it can also go APKs, Android APKs it can do whatever tools so all the different helper tools make it quite big then I started to set up test reproducible which in the beginning was just called reproducible Debian net and in the beginning we only tested Debian by just building a package twice and compare and then we started to add more variations that we changed the user name changed the time zone changed whatever parameters and now we're also not only testing we test all three Debian suits they're constantly on four architectures and we also but also test OpenWRT, NetBSD FreeBSD we used to have tests for Arch Linux but at the moment not working and it's a giant Jenkins setup with 44 nodes and terabyte of RAM so it builds Debian twice and two to four weeks constantly and it's also now there's many people working on this setup so this is how we vary the build and this varying the build is done to try to catch variations there will be more variations in the wild but we assume if we just vary this we will find most likely cases so we vary the host name, the domain name the time zone, the location the user built with different kernel versions on i386 we built with a 64-bit kernel and a 32-bit kernel we have some architectures where we have different CPU types the file system order is also important because we fear the order is not deterministic or depends on the i nodes which can change and we also have systems running in the future so we have systems running a year and a month and a few days in the future so we can see what breaks which is also funny because we also find bugs where certificates expire and if you want to reproduce something in two years then that's bad so maybe we should also not just build one year in the future but five years in the future but then we will catch more errors and we want to find less errors so what we found mostly it's time stamps time stamps are either the file time stamps or also very common is that the time stamp is outputted in the build product not so much in the program but more in documentation so the main pages are often included this was built on this state which is really meaningless if you can rebuild on every day any day and get the same and also the time zone if you unpack a zip archive from 20 years ago the local time zone will be applied and that goes on the build product again the locates are also in there the build pass and everything else is some other corner cases but it's mostly these four things that make stuff unreproducible and it's also sorting order is different depending on the locate not for the alphabet but for the special characters and then you get this if you don't sort hashes then you also get an arrays they have run in order and it's often easy you call gzip-n to have time stamps in UGC this is all on this documentation that's our web page now besides this documentation part on the web page there's also Lunar gave a talk at the CCC camp two years ago where you have many examples with problems and the solution so if you want to watch a video this is another good video to watch and then we came up with source state epoch because the build date is usually not meaningful but the epoch is the last modification of the source code as an epoch so in seconds and this can be used instead of the current date it can be used in random seats so they become pseudo-random in Debian we set this from the latest Debian change lock entry could also be the last git commit or whatever and we wrote a spec which is two or three kilobytes of architects so it's really short you can read it in three minutes or five whatever it has been adopted by many distributions and tools like this there's patches for RPMD package support the GCC, ghost script it's more than 50 tools now which support source state epoch so if source state epoch is not set tools use the current time and date and if it's set they will use that and then we wrote two more tools strip non-determinism does that so it removes time stamps from images or other time stamps which are clearly meaningless they are just set to zero and in the Debian case we call it with step helper so all packages which use step helper which are 90% use it automatically so strip non-determinism is not used by other distros yet but it will increase the percentage of stuff which is reproducible and the other tool which we started to write in the last half years re-protest which builds something then applies variation and then builds it again so what we do on this big Jenkins setup this is also something for you to use so you can build something with re-protest but it's the same I'm not sure if anybody has tried it with building RPMs yet so in Debian the status in Debian this is testing and testing is now 93.3% reproducible which I think is fairly great we're getting further slower but on the other hand three months ago we're still at 91% so there is still progress happening and then we had the idea hmmm we don't vary enough so for unstable we started to vary the build pass for testing we still use a deterministic build pass which is basically slash build D slash source slash version and there we use build and random pass and the build pass gets embedded in lots of stuff so we only get percent reproducibility there so what we think we will do for for currently we say use a deterministic build pass but we want to be able to build in any pass because developers will do the same I want to compare if I build in home Holger and he builds in home Dennis then I also want to compare this but this might take some time we have patches for GCC but GCC is just first GCC is only built used for half the archive or something and then there's also lots of stuff in documentation generators so at the moment we still recommend to not vary the build pass and just say use some standard pass then because just looking at those 25,000 Debian packages is too much to grasp we have package sets as well so we have whatever GNOME package set the base set all the Perl packages all the Ruby packages all the whatever packages and so Debian the essential set which is 20 source packages or 30 is now reproducible except Bash and GCC 6 I think and GCC is the documentation so the other package sets are not that reproducible yet but it's that helps to look at people and we categorize issues so we have a system to take notes and we found 282 different issues so whatever it is Erlang embeds the build pass and GNUT Pundock puts something in there or local variation these are all these different issues and we found 7,000 packages still which have some kind of issues even though they're not and we've looked at almost all packages so there's like 100 something packages left which we don't have a know but we don't have an idea and we want to also make these node cross distro because if something is most likely the issues are the same on Fedora and FreeBSD even because it's all the same upstream software and then to rebuild we came up with build info files which the source code uses with the check sum the generated binaries which is the stuff you want to reproduce and the environment so they use later can be used to recreate the same environment because you need to have the same versions installed it's you cannot guarantee that you get the same results and for Debian it's quite easy because all the old versions are available on Snapshot, Debian and Net I have no idea how to get old Fedora versions especially during development but it's all in Koji it's all in Koji in 30 terabytes a disk that's the same size as Debian and this is the the green ones are the fixed bugs and the red ones are the open bugs those are all bugs with reproducible issues and we only file bugs with patches because as it's useless it's just saying the package is unreproducible please fix there's not a meaningful bug report so all these 800, what is it? 700 I think we have left open where we have patches to make software reproducible and most likely you can take them while we did this we rely on the Debian maintainers upstream which some maintainers do and some maintainers don't so now Bernhard Wiedermann from OpenSusers started another project where he's actively sending patches upstream I think so far he has sent 100 patches upstream but this is he started that mid-December last year so that's not a long time ago at the moment this was a proof of concept until very recently our changes to de-package the central packaging tool were only accepted in Debian in November so since November de-package in Debian Unstable can create reproducible packages and since December it stores only the build info files so when Debian stretch will be frozen in nine days and we will not have many reproducible packages in there because Debian doesn't well Debian doesn't do rebuilds so at the end of the free cycle Debian doesn't rebuild everything for historic reasons I think it's crap but that's why Debian stretch will not reproducible not the 90% on the other hand if somebody else takes Debian stretch they will get the 90% but Debian doesn't have it I'm not so happy about that and we also don't distribute the build info files yet we save them but we don't have a mechanism to move them and this is also quite unclear still how to do that but Debian stretch now or whatever the unstable and make either 1704 or 1710 partly reproducible so Debian 10 in 2019 will be partly reproducible yay and for Debian 11 in 2021 or whatever it is I think we should have policy mandate if it's not reproducible then it will not be released but it's a long way since basically the beginning we realized it's not enough to only care about Debian but these changes needs to go into upstream so we made a we started to write reports weekly report which is a blog where we document our progress and development and discussions and stuff and we made now two summits one in December 2015 and one in 2016 2016 Dennis joined us there and Bernard Wiedemann from ZUSA was also there there were like now there were 25 projects 2015 there were 20 projects or so and we will do another summit this year if you want to go there please talk to me we would be happy to have more Fedora people there it's sponsored by the Linux foundation and Google mostly so please talk to me if you want to go there we also did two we're doing the third round of outreach two Google summits and three outreach rounds which also brought new contributors which was really good so now for the stuff which probably interests you more so these we also test now with variations on this Jenkins on the Stabian Jenkins we built now FreeBSD and NetBSD all the other stuff core boot used to be called Linux BIOS before core boot is 100% reproducible with the CBIOS payload the problem with core boot is they don't do releases at all so they have reproducible theory Net and FreeBSD is almost also in the 70-80% range it's usually the base system which is more problematic the packages are basically the same and there's more until last week I thought that Bitcoin was where the first because the Bitcoin developers they were in 2011 Bitcoin had a market capitalization from four billion dollars and they thought there's a compromise Bitcoin binary which steals the Bitcoin and put it somewhere else the developers could not prove that they didn't make it so they made reproducible so they could be sure the binary you're running is really coming from the source code and toward it then the same with the tour browser which is Firefox as you probably know so there was clear okay you can also do it with really big binaries and that motivated then Debian started in 2014 and last week I learned that Cygnus this company which made GCC and other stuff in the 90s they had a bit by bit binary bit by bit identical releases in 1992 for eight architectures but that code bitwrote it so and now it's completely forgotten and when I read this last week I was like wow um ElectroBSD had a talk last year at FOSTA where they made ElectroBSD as a small, freeBSD variant with a small base system that was 100% reproducible which was the first major distro um Tails is working on their image I think they made almost their web converters as another live distro which where the images are 100% reproducible Google Bazel is the Google build tool which aims for reproducible builds reproducible is a build tool for windows so you can create reproducible windows binaries and there's few commercial proprietary software which is reproducible yes which Windows there's at least source code for iOS there's not even source code Microsoft says there's source code so medical devices in your body arms, drones whatever nuclear power plants, self-driving cars they are all not reproducible gambling machines are reproducible by law for tax reasons in Germany and France so that started with this started in December to build SUSE twice in this open SUSE build system and he built 3000 packages now and managed to get 2000 of them bit by bit identical and 1000 and I've set this up with Fedora 23 so it was in 2015 but there I didn't have a patch RPM so there was no result and that bit rotted as well so for basics in Fedora Diffoscopes available there's a new release of it yesterday so we don't have the latest in Ryde and Fedora 25 and 24 we have the previous version so you can test your binaries today to see what the differences are between builds which is useful we have a few issues potentially in recording all the build info kind of data YUM and DNF do different things so if you create a build route with YUM I created with DNF we potentially got some problems because they resolve different dependencies which may result in different binary hopefully not but it's an area that could cause problems because in RPM 413 they added a macro to set the build host name so you can define the build host is Fedora and then every build will have Fedora as the build host instead of whatever the host actually was that you build it on in order to try and make the whole bit by bit reproducible and we get a few issues with signed RPM so Koji itself drips the RPM header out and has an unsigned header when we sign it we strip the signed header out and we tell Koji write the signed RPM and it gets the payload and shoves the correct header in there so in theory we could reuse that so that you could take the binary RPM that you want to reproduce strip the header off the signed header, reproduce the build shove the signed header in and it should be bit by bit reproducible it's probably a bit ugly and I'm getting dirty books back there from RPM folks but it should work it's a bit of theory but we also have issues where in the devian case they're looking at adding the check sums of the RPM's that went into the build environment in Koji we use unsigned RPM's in all the build routes if you're using Mock at home you're going to get signed RPM's of all of the RPM's going into the build routes so it's going to make that may be something we just say we're not putting check sums in there because you can go from signed to unsigned contents is exactly the same sense the signature header and the build is reproducible or not yes sir we could potentially strip the signature before we check some but it depends on where we fit it all in as well and the cost of stripping that out and getting all that information we certainly don't want anything that we're going to do in Fedora we don't want to have it be overly burdensome or too intensive where the cost of being enabling people to reproduce our builds is so high that people want to turn it off because it adds 5-10 minutes to their builds people complain already that the init of a churrut takes too long and they want to do things so that we can make the churrut appear faster so they can get their build 2 minutes earlier so we had something that's time consuming it's not going to help at all but that's kind of the basic part there's a whole bunch of 2-2 type things the equivalent of the build info file we have probably 80% of the data 90% of the data in Koji already it's just not easy to get we store all you know for a long time we've said we do things the way we do so that we can reproduce the builds and practice done that we've not no one's ever actually sat down and said okay well I want to reproduce this build in Koji they're just like oh we've got this stuff we can reproduce it so it's kind of looking at it it's really just going from the theory of reproducibility to practically being able to reproduce stuff and say hey you know what you can trust that fedora is what we want because here's the information that you need to reproduce the builds the format of how we present that information to the users needs to be decided on I think that there's probably 2 aspects that we want to 2 places where we want to do it we don't want to have to have people that want to reproduce that up Koji but it's going to be really nice and convenient that since Koji has all the information that you know we have an API call I'm rebuilding foo1.1-1 give me the build info and you can get that information so I think Mock needs to have the ability to write out a log file or write out a file that has all of the same information that you would get from a Koji call to get the build info and I say Mock and not RPM build because in the case of say if you're building a rail 5 RPM like for Apple in Koji today the churrut is set up by the build host which in the fedora case is fedora25 so you're setting up a rail 5 churrut on fedora25 and rel5.pm cannot read fedora25's RPM databases so if you wanted to like do rpm-qa in the build it's going to blow up and choke and you're not going to get builds so I think Mock needs to use the system's RPM to be able to tell you which it does already in the root.log but put it in the right format right it should be able to do it in other ways but like if you wanted to make RPM do it you'd have to read the RPM database to query these with the RPM's installed in the churrut which in many cases there's a reason why we banned any call to RPM inside of the builder in the packaging guidelines and it's not because we want to be jerks or anything it's that we can't guarantee that you can do it it works sometimes and other times it won't there's some defiants that need to be set in the environment like so state epoch the Susie guys told me yesterday they're working on a patch that will set a macro to get from the RPM changelog and set the source state epoch and they're telling me they're going to send it upstream so hopefully that should come with time we already record the sources we already record the output we know what RPM's we get from the build so we have most of the data we just need to put it together in a format that's consumable which will then allow us to write some tools where we can wrap around Mock and say hey we're going to re-produce this build it sets up the chur, it sets up the build environment builds everything and hopefully gets the reproducible builds out at the end but it's quite we've probably got 90% of what we need with Koji without any thought or effort and the last piece is going to take some work and people to work on it but I think it's something that's reasonably doable the next 12 to 18 months the hardest bit would be setting up something either using test.reproduciblebuild.org or getting Google or NASA or whoever to actually reproduce builds and provide us with or even set up something ourselves where we can reproduce the builds but then do you trust this to provide the verification of ourselves but yeah it's something that I think is really reasonably doable with reasonably minimal effort because we're doing most of what's needed already but Suzy uses zipper I looked at the equivalent of Mock and they use about a 1400 line bash script but to do the equivalent of what we do in Mock so I'm not sure how like in that portion I'm not sure if there's going to be a lot of overlap between like Suzy and us in Fedora so so far this was mostly about making reproducible builds possible at all enabling us to do this but for the future we need first constantly testing this whether we with that bitrots or not which is not doing so and then we still need tools infrastructure and policy to for this become meaningful for users so we need these build info files and infrastructure to distribute them because there will be Debian has 25,000 source packages so 10 architecture so that's probably 100,000 files for one release and how to distribute that and we want to sign these and there's almost no work being done yet so far we've only been focusing on making reproducible builds possible and maybe there's probably very different projects different solutions so if so far the reproducible builds making it possible that it's the same source code and we can share the work but how we build these tools that will be not so shareable and we need something like build info files everywhere we have them for Debian we have some for core boot and OpenWRT and Fedora Dennis just explained how to do that but this is all for the other projects this has not really been done and then this having individuals doing the rebuilds we don't think that would scale so maybe large organizations like ACLU Greenpeace, NASA the NSA, the Russian Army the North Korean Army, the US Army they all rebuild and agree or we do Fedora rebuilds Debian and Debian rebuilds NetBSD or big customers rebuild it themselves there could be several different models and it's also you need to decide whom you trust and what you do if you find get one checksum which is not matching and this is all future work for the next years to come and then we need integration in user tools we really want to install this one reproducible software or do you want to build it yourself first and then compare the checksum and how many science checksums do you need to call a package reproducible and from whom isn't that what Nick Zawias is doing all the time kind of there's Geek's challenge which is a tool to rebuild and do the stuff once you get the RPMs and packages reproducible you then can also look at things like live CDs the Anaconda installers and cloud images and all the other binary artifacts that we deliver there's a couple of people that were working on a lot of the live CD stuff like McSquash FS apparently does things that make you can install everything exactly the same way and you won't get a reproducible ISO out of it because it does stuff differently and so they're working on fixing that so that once we've got the base done there's places under higher up in the stack that can be made reproducible also once you create images with file systems the file systems need to be reproducible and they all put timestamps in there so Squash FS was recently fixed but there are other file systems which are not fixed yet so if you want to get involved as a software developer please stop using build dates if you really have to use source date epoch and you could also look at your distribution like build, fit or twice build the packages you maintain twice just build them half an hour later or two minutes later see whether they are quite identically with lots of documentation I'll be here for the next two days as Dennis as well can also talk to us yeah that's it questions? there is for re-protest re-protest is our builder tool for developers and so there's the idea bit like bisecting twice with all variations and it's the same but if it varies then you stop varying whatever the locale if it's then reproducible you know it was the locale but that would mean that you maybe need to build the software 10 times and maybe you still don't find the reason but that should help we're going to place things like unreproducible we all know from instant ps certificates and we don't want to ask we just want to set some same defaults and then say sorry there's something wrong which I kind of installed at this time or whatever it's kind of like a DNF plugin that could do something and it could be that there's a system-wide policy that says by default we set it that reproducible software can't be installed in the metadata that's already too big and you know I think that I totally agree we need to think about this more these are all old thoughts and we've not spent much any time on user tools in the last year what is the other biggest besides build dates which makes builds unreproducible and that is build pass so for build pass we can use an easy workaround just use a deterministic build pass so then I think the next biggest is probably locale time zones and which again we can fix easily by forcing time zone to UTC before the build this is from Debian we want to allow developers to build in their environment as it is the other thing is also the locales indeed we want developers to get error messages in French or German or whatever I'm not forced them to English soft soft so this you can if you normalize the build environment you can get a lot many things done and Koji is a tool to normalize the build environment Debian has also these tools but Debian they are less strict but if you are really strictly enforcing the build environment you get a lot of things how many problems do you get from different file systems? we only looked at packages so far so we have only a few packages which include a file system I mean the question was what are the difference what differences do you get by using different file systems like XFS or EXT3 EXT4 you can get quite a lot if the sorting of the file systems is different depending on how they list things out and do things we case by case mostly it's sorting issues because the read year order is different and we wrote another tool which I didn't mention which is called DisorderFS which is doing that it's a fuse file system which randomizes the read year order and there was the test frame where we catch those cases at some point the question was do we plan to update the packaging guidelines to include something for reproducible builds probably at some point so the patch that the Suzy guys were working on for RPM was to set a macro called sorted epoch from change log and the idea is that it gets the last change log entry and whatever time that was we only use dates but whatever time that was it would set to 0, 0, 0, 0 for the actual time of that and if we're going to do something in Fedora we would probably put in Fedora release and set that macro it's set globally then and anyone doing a build it would just kind of get turned on but we would probably need to and we would need documentation on when if you get failures you get issues this is how you debug it and work on fixing the issues but I don't know that there's necessarily anything specific we need to set you know like having packages set the macro in every spec file is not going to work it needs to be set some way globally and as packages get their work done regardless of the package that we built it's getting changes upstream as far as possible so that the tools that produce artifacts produce them reproducibly so if the CCC gets changed if the tools gets changed if the target gets changed it's not about fixing they're doing moves files they're working on a bit files they're making a whole system to build so that way you don't need to change everything on a package unless you want to do it temporarily until you get the patch upstream so it doesn't really go on guidelines in the end yeah just to avoid probably wouldn't yeah he said that it's not about changing the packages but rather changing the tool change upstream so that we don't need so many guidelines which yeah we got the last question so and one thing what we did in evidence we changed the policy to say we have not even said at the moment there's nothing in policy so what's the first change we want to have should be reproducible and then later must be reproducible so it's a long process last question how we deal with build systems that are not GCC based like I think how we deal with build systems other than GCC the same way as with GCC we try to find the course and send the patch upstream and there's probably there's probably rust an example of where things went wonky there the build hardware builders in Fedora use the build hardware have I think 16 cores and like 64 gig of RAM and the build VMs have got 4 cores and like 8 gig of RAM or 16 gig of RAM something like that but GCC when it was built on the build VMs would get one hash it was consistent but you got one hash and if you built them on the build hardware they got a completely different hash that it used in the shared objects and so then you'd have to rebuild everything else because it was like this difference that was introduced into the package purely based on what machine you built it on and how fast it could do certain things cause it to give differences in the build result that's something we've seen in Fedora so thank you very much everyone any of the builds we've got we've got the software and so I've already trucked in all the things how they start finding them that's good let's move away you can build levy packages and this is a how well it's for the the history of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the web of the