Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ceph for openSUSE:Factory checked in at 2026-08-11 17:09:57 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ceph (Old) and /work/SRC/openSUSE:Factory/.ceph.new.17972 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ceph" Tue Aug 11 17:09:57 2026 rev:107 rq:1370542 version:18.2.7 Changes: -------- --- /work/SRC/openSUSE:Factory/ceph/ceph.changes 2026-06-03 20:21:13.366202327 +0200 +++ /work/SRC/openSUSE:Factory/.ceph.new.17972/ceph.changes 2026-08-11 17:10:18.864706578 +0200 @@ -1,0 +2,7 @@ +Thu Aug 6 14:16:58 UTC 2026 - Bernhard Wiedemann <[email protected]> + +- Achieve reproducible builds (boo#1274069) + * Simplify cephadm-reproducible.patch + * Add cephadm-source-date-epoch.patch + +------------------------------------------------------------------- New: ---- cephadm-source-date-epoch.patch ----------(New B)---------- New: * Simplify cephadm-reproducible.patch * Add cephadm-source-date-epoch.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ceph.spec ++++++ --- /var/tmp/diff_new_pack.WgzXKy/_old 2026-08-11 17:10:22.048841537 +0200 +++ /var/tmp/diff_new_pack.WgzXKy/_new 2026-08-11 17:10:22.052841705 +0200 @@ -226,6 +226,8 @@ Patch16: ceph-liburing-build-fix.patch # PATCH-FIX-OPENSUSE ceph-gcc16-build-fix.patch -- fix build with gcc 16 Patch17: ceph-gcc16-build-fix.patch +# PATCH-FIX-OPENSUSE cephadm-source-date-epoch.patch -- reproducible zip timestamps in cephadm +Patch18: cephadm-source-date-epoch.patch %if 0%{?suse_version} # _insert_obs_source_lines_here ExclusiveArch: x86_64 aarch64 ppc64le s390x riscv64 ++++++ cephadm-reproducible.patch ++++++ --- /var/tmp/diff_new_pack.WgzXKy/_old 2026-08-11 17:10:22.196847810 +0200 +++ /var/tmp/diff_new_pack.WgzXKy/_new 2026-08-11 17:10:22.204848149 +0200 @@ -1,88 +1,35 @@ +From e8ac633cf9acdd102adb8e4977e009e988670848 Mon Sep 17 00:00:00 2001 +From: "Bernhard M. Wiedemann" <[email protected]> +Date: Thu, 6 Aug 2026 08:27:11 +0200 +Subject: [PATCH] cephadm: do not embed random build path into binary + +build.py byte-compiles the sources in a directory made by +tempfile.mkdtemp and the random path was recorded in the co_filename +of the code objects shipped in the cephadm zipapp, so every build +produced a different binary. + +Pass ddir="" to compileall.compile_dir so that only the path relative +to the build directory is recorded in the pyc files. + +This patch was done while working on reproducible builds for openSUSE. +Fixes: https://bugzilla.suse.com/show_bug.cgi?id=1249586 + +Signed-off-by: Bernhard M. Wiedemann <[email protected]> +--- + src/cephadm/build.py | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/src/cephadm/build.py b/src/cephadm/build.py +index 4264b814f1..6f359ec560 100755 --- a/src/cephadm/build.py +++ b/src/cephadm/build.py -@@ -12,7 +12,6 @@ import os - import pathlib - import shutil - import subprocess --import tempfile - import sys - - HAS_ZIPAPP = False -@@ -57,11 +56,12 @@ def _did_rexec(): - def _build(dest, src, versioning_vars=None): - """Build the binary.""" - os.chdir(src) -- tempdir = pathlib.Path(tempfile.mkdtemp(suffix=".cephadm.build")) -- log.debug("working in %s", tempdir) -+ builddir = pathlib.Path(".cephadm.build") -+ os.mkdir(builddir) -+ log.debug("working in %s", builddir) - try: - if os.path.isfile("requirements.txt"): -- _install_deps(tempdir) -+ _install_deps(builddir) - log.info("Copying contents") - # TODO: currently the only file relevant to a compiled cephadm is the - # cephadm.py file. Once cephadm is broken up into multiple py files -@@ -69,19 +69,19 @@ def _build(dest, src, versioning_vars=No - # sort organized structure to track what gets copied into the - # dir to be zipped. For now we just have a simple call to copy - # (and rename) the one file we care about. -- shutil.copy("cephadm.py", tempdir / "__main__.py") -+ shutil.copy("cephadm.py", builddir / "__main__.py") - if versioning_vars: -- generate_version_file(versioning_vars, tempdir / "_version.py") -- _compile(dest, tempdir) -+ generate_version_file(versioning_vars, builddir / "_version.py") -+ _compile(dest, builddir) - finally: -- shutil.rmtree(tempdir) -+ shutil.rmtree(builddir) - - --def _compile(dest, tempdir): -+def _compile(dest, builddir): - """Compile the zipapp.""" - log.info("Byte-compiling py to pyc") - compileall.compile_dir( -- tempdir, -+ builddir, - maxlevels=16, +@@ -86,6 +86,8 @@ def _compile(dest, tempdir): legacy=True, quiet=1, -@@ -91,7 +91,7 @@ def _compile(dest, tempdir): - log.info("Constructing the zipapp file") - try: - zipapp.create_archive( -- source=tempdir, -+ source=builddir, - target=dest, - interpreter=sys.executable, - compressed=True, -@@ -100,14 +100,14 @@ def _compile(dest, tempdir): - except TypeError: - # automatically fall back to uncompressed - zipapp.create_archive( -- source=tempdir, -+ source=builddir, - target=dest, - interpreter=sys.executable, - ) - log.info("Zipapp created without compression") - - --def _install_deps(tempdir): -+def _install_deps(builddir): - """Install dependencies with pip.""" - # TODO we could explicitly pass a python version here - log.info("Installing dependencies") -@@ -121,7 +121,7 @@ def _install_deps(tempdir): - "--requirement", - "requirements.txt", - "--target", -- tempdir, -+ builddir, - ] + workers=0, ++ # do not embed the random tempdir path in the pyc files ++ ddir="", ) - + # TODO we could explicitly pass a python version here + log.info("Constructing the zipapp file") ++++++ cephadm-source-date-epoch.patch ++++++ >From 6ccf662807337ef314a5e8a714bfb7fed4880cfd Mon Sep 17 00:00:00 2001 From: "Bernhard M. Wiedemann" <[email protected]> Date: Thu, 6 Aug 2026 08:27:38 +0200 Subject: [PATCH] cephadm: honor SOURCE_DATE_EPOCH for zipapp timestamps zipapp.create_archive stores the mtime of each file in the zip entries, so the cephadm binary differed between builds. Clamp the mtimes of the freshly generated files to SOURCE_DATE_EPOCH when it is set, as described in https://reproducible-builds.org/specs/source-date-epoch/ This patch was done while working on reproducible builds for openSUSE. Signed-off-by: Bernhard M. Wiedemann <[email protected]> --- src/cephadm/build.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/cephadm/build.py b/src/cephadm/build.py index 6f359ec560..c611662fc5 100755 --- a/src/cephadm/build.py +++ b/src/cephadm/build.py @@ -89,6 +89,7 @@ def _compile(dest, tempdir): # do not embed the random tempdir path in the pyc files ddir="", ) + _clamp_mtimes(tempdir) # TODO we could explicitly pass a python version here log.info("Constructing the zipapp file") try: @@ -109,6 +110,20 @@ def _compile(dest, tempdir): log.info("Zipapp created without compression") +def _clamp_mtimes(tempdir): + """Clamp file mtimes to SOURCE_DATE_EPOCH so that the timestamps + stored in the zipapp are reproducible. + https://reproducible-builds.org/specs/source-date-epoch/ + """ + epoch = os.environ.get("SOURCE_DATE_EPOCH") + if not epoch: + return + clamp = int(epoch) + for path in [tempdir, *tempdir.rglob("*")]: + if path.stat().st_mtime > clamp: + os.utime(path, (clamp, clamp)) + + def _install_deps(tempdir): """Install dependencies with pip.""" # TODO we could explicitly pass a python version here
