Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package erlang for openSUSE:Factory checked in at 2026-08-20 16:15:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/erlang (Old) and /work/SRC/openSUSE:Factory/.erlang.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "erlang" Thu Aug 20 16:15:06 2026 rev:145 rq:1372101 version:28.5.0.4 Changes: -------- --- /work/SRC/openSUSE:Factory/erlang/erlang.changes 2026-04-20 16:12:15.231516009 +0200 +++ /work/SRC/openSUSE:Factory/.erlang.new.1258/erlang.changes 2026-08-20 16:15:16.803216635 +0200 @@ -1,0 +2,243 @@ +Wed Aug 5 04:38:54 UTC 2026 - Simon Lees <[email protected]> + +- Fixes for reproducable builds + * fix-reproducible-asn1.patch + * fix-reproducible-docs-time.patch + * fix-reproducible-erts-time.patch + * fix-reproducible-zip.patch +- Refreshed the following patches + * erlang-not-install-misc.patch + * otp-R16B-rpath.patch + +------------------------------------------------------------------- +Tue Aug 4 09:44:12 UTC 2026 - Simon Lees <[email protected]> + +- Update to 28.5.0.4 Numerous Fixes including + - CVE-2026-42792: epmd permanent DoS via EMFILE on accept(2) in + erts (bsc#1272908) + * fix-CVE-2026-42792.patch + - CVE-2026-47078: Relative path traversal in zip:unzip/zip:extract + via check_dir_level depth-counter bypass (bsc#1272909) + * fix-CVE-2026-47078.patch + - CVE-2026-48855: Exposure of Sensitive Information to an + Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd + module) allows File Discovery. The SSH_FXP_READLINK handler in + ssh_sftpd sends the raw result of file:read_l ... (bsc#1268139) + * fix-CVE-2026-48855.patch + - CVE-2026-48856: Sensitive Data Exposure vulnerability in Erlang + OTP inets (httpc_response module) allows Retrieve Embedded + Sensitive Data. The httpc client forwards the Authorization and + Proxy-Authorization request headers to ... (bsc#1268141) + * fix-CVE-2026-48856.patch + - CVE-2026-48858: Server-Side Request Forgery (SSRF) allows FTP + bounce attacks and SSRF via an unvalidated PASV response IP + address. (bsc#1268142) + * fix-CVE-2026-48858.patch + - CVE-2026-48860: Erlang/OTP ssl (inet_tls_dist module) allows + unauthenticated bypass of the distribution-over-TLS LAN allowlist + (bsc#1268146) + * fix-CVE-2026-48860.patch + - CVE-2026-49759: Stack-based Buffer Overflow vulnerability in + Erlang OTP erts (inet_drv). (bsc#1268163) + * fix-CVE-2026-49759.patch + - CVE-2026-49760: Stack-based Buffer Overflow vulnerability in + Erlang OTP (erl_interface). (bsc#1268164) + * fix-CVE-2026-49760.patch + - CVE-2026-53422: SFTP REALPATH path-existence oracle allowing + filesystem enumeration outside configured root (bsc#1270245) + * fix-CVE-2026-53422.patch + - CVE-2026-54886: SSH SFTP server denial of service via extended + channel data infinite loop (bsc#1270246) + * fix-CVE-2026-54886.patch + - CVE-2026-54887: Use of Default Cryptographic Key vulnerability + allows predictable DTLS cookie computation during the startup + window (bsc#1270247) + * fix-CVE-2026-54887.patch + - CVE-2026-54890: BEAM VM crash via integer underflow in + binary_to_term BIT_BINARY_EXT decoding (bsc#1272916) + * fix-CVE-2026-54890.patch + - CVE-2026-54891: erlang: Erlang SSL: Unauthenticated data + injection during TLS handshake (bsc#1270250) + * fix-CVE-2026-54891.patch + - CVE-2026-55737: Heap pointer corruption via signed/unsigned + mismatch in LARGE_TUPLE_EXT decoding in erts external term format + decoder (bsc#1272910) + * fix-CVE-2026-55737.patch + - CVE-2026-55950: Time-of-check Time-of-use (TOCTOU) race condition + vulnerability allows an unauthenticated remote attacker to crash + all active DTLS sessions on a listener (bsc#1270253) + * fix-CVE-2026-55950.patch + - CVE-2026-55952: The Erlang/OTP ssl application does not validate + that the PSK identity list and binder list carried in a TLS 1.3 + ClientHello pre-shared key extension have equal length before + passing them to the session ticket ... (bsc#1270258) + * fix-CVE-2026-55952.patch + - CVE-2026-55953: TLS 1.2 and DTLS client accepts unoffered + anonymous cipher suite, bypassing server authentication + (bsc#1272911) + * fix-CVE-2026-55953.patch + - CVE-2026-58227: TLS/DTLS denial of service via unbounded + recursion on cross-signed peer certificate chain (bsc#1272913) + * fix-CVE-2026-58227.patch + - CVE-2026-59250: Megaco flex scanner buffer overflow via oversized + property parm name (bsc#1272914) + * fix-CVE-2026-59250.patch + - CVE-2026-59251: Denial of service via exponential certificate + policy tree growth in path validation (bsc#1272915) + * fix-CVE-2026-59251.patch + +------------------------------------------------------------------- +Fri May 29 04:32:29 UTC 2026 - Simon Lees <[email protected]> + +- Changes for 28.5.0.1 + * CVE-2026-42790: Name Constraints and Subject CommonName + fallback in TLS hostname verification allows for certificate + forgery by MITM attacker (bsc#1266466) + * CVE-2026-42791: OCSP response verification in the `public_key` + application does not check the validity period of the OCSP + responder certificate and allows for OCSP response response + forgery (bsc#1266448) + * CVE-2026-42789: `public_key` application accepts non-CA + certificates as intermediate issuers and this enables chain + forgery (bsc#1266449) +- Remove "%make_build clean" before build, this now breaks the build +- docs are broken on i586 + * https://github.com/erlang/otp/issues/11156 + +------------------------------------------------------------------- +Mon May 11 15:13:47 UTC 2026 - Andreas Schwab <[email protected]> + +- Remove unneeded constraints + +------------------------------------------------------------------- +Sun May 10 12:15:39 UTC 2026 - Matwey Kornilov <[email protected]> + +- Changes for 28.5: + * erl_interface: A new configure option [--{enable,disable}-use- + embedded-3pp-alternatives ](%60e:system:install.md#advanced- + configuration-and-build-of-erlang-otp_configuring%60) has been + added. When enabled, configure is forced to find alternatives, + to a subset, of the embedded third-party products (3pps) in the + runtime system, and when disabled, configure will use all + internal embedded 3pps. Currently this option affects zstd, + zlib, ryu (with STL), openssl and tcl. The default is to use + all built-in embedded 3pps except for zlib which by default + will use zlib on the OS if available. + * erl_interface: The ei API for decoding/encoding terms is not + fully 64-bit compatible since terms that have a representation + on the external term format larger than 2 GB cannot be handled. + * mnesia: Added documentation for user_properties and functions + read_table_property/2, write_table_property/2, + delete_table_property. Enhanced documentation for + frag_properties. + * mnesia: Fixed a bug where stacktrace was not returned from + mnesia:transaction/1 when transaction aborts with an error + exception. + * erts: Fixed bug in enif_make_map_from_arrays for arrays with at + least 33 keys. If duplicate keys existed, instead of failing, + it would skip the duplicates. If less than 33 unique keys + existed, an internally inconsistent and broken map was + returned. + * erts: Fixed an issue when supplying the args_file option to + erl.exe on windows that did not handle unicode characters + correctly. + * erts: A new configure option [--{enable,disable}-use- + embedded-3pp-alternatives ](%60e:system:install.md#advanced- + configuration-and-build-of-erlang-otp_configuring%60) has been + added. When enabled, configure is forced to find alternatives, + to a subset, of the embedded third-party products (3pps) in the + runtime system, and when disabled, configure will use all + internal embedded 3pps. Currently this option affects zstd, + zlib, ryu (with STL), openssl and tcl. The default is to use + all built-in embedded 3pps except for zlib which by default + will use zlib on the OS if available. + * ssl: Preserve inet option order, as inet_backend option must be + first option. Will make inet_backend option work for ssl + independently of number of inet supplied options. + * ssl: Missing conformance check for signature algorithms in + TLS-1.3 could cause selection of incompatible certificate when + a server is configured with more than one possible certificate. + * ssl: Avoid unnecessary memory consumption for temporary + processes in a supervision tree. +- Changes for 28.4.3: + * kernel: On Windows, sockets has to be bound when using + 'socket'. Therefor when using gen_tcp with inet_backend = + socket, gen_tcp_socket bind even if the caller has not provided + an explicit bind address. In that case it attempts to locate a + "proper" address on its own. But if the connect address is the + loopback address, this could lead to an attempt to bind to an + external interface. So, this has now been changed so that if + the connect address is the loopback address, the loopback + address will also be used when binding. + * ssh: Fixed a vulnerability in the SFTP server where file + attributes could be modified outside the configured root + directory. When using FSETSTAT on an open file handle, the + operation used the path stored in the handle without verifying + it was within the root directory, allowing attribute changes to + files outside the chroot boundary. +- Changes for 28.4.2: + * public_key: OCSP designated responder certificate verification + now checks the CA's cryptographic signature on the responder + certificate. Previously, only the issuer DN match and id-kp- + OCSPSigning EKU were verified, which meant a forged self-signed + certificate with the CA's subject DN would be accepted as a + valid designated responder (Case 2 in RFC 6960 §4.2.2.2). + * public_key: Update handling of encoding + 'OTPSubjectPublicKeyInfo' in public_key:pkix_encode/3, so that + it works for update spec added in OTP-28. + * public_key: Relax upper bound of common names in certificates + for pragmatic interoperability reasons. + * kernel: Before this patch, the Erlang/OTP built-in DNS resolver + (inet_res) used a sequential, process-global 16-bit transaction + ID for UDP queries and did not implement source port + randomization. Response validation relied almost entirely on + this ID. Together, this made DNS cache poisoning practical for + an attacker who can observe one query or predict the next ID. + The design conflicted with RFC 5452 recommendations for + mitigating forged DNS answers. + * sasl: Fixed the typespec of + release_handler:eval_appup_script/4. + * erts: Fixed a JIT bug that miscompiled expressions like X * X + + X * X. + * erts: Fixed bug on windows that made tools dialyzer, erlc and + typer unusable in powershell or cmd.exe, when there are spaces + in the installation path. + * erts: Fixed a bug with prim_tty that could occur on windows if + we cannot get the console mode, mark the TTY as unavailable. + This can happen when the input handle is a pipe, but the output + handle is a console. + * inets: Fixed authentication bypass in httpd when script_alias + maps a URL to a directory outside document_root with mod_auth + directory-based access controls. The mod_alias:which_alias/1 + function now includes script_alias entries so authorization is + evaluated against the correct path before CGI execution. + CVE-2026-28808. + * inets: Fixed typo in http_server.md guide + * inets: Expected error accept_socket_timeout in + httpd_request_handler now exits gracefully, without generating + a crash and supervisor reports. + * ssl: Server supporting TLS-1.3 and TLS-1.2, with SLH-DSA + algorithms for TLS-1.3, now correctly filter out those + algorithms if client is TLS-1.2 only, instead of failing with + internal error. + * ssl: When OCSP stapling is enabled via the {stapling, staple} + or {stapling, #{...}} options, the handshake now fails if the + server does not provide an OCSP stapled response. + * compiler: The type inference for maps:from_list/1 was + incorrect: when the provided list was statically known to be + bogus when non-empty (e.g. a list of atoms), the compiler + assumed it would also fail when the list was empty. + * compiler: Fixed a bug in the type analysis pass that could + erroneously eliminate code blocks. + * compiler: A binary as the value of a -moduledoc() attribute + would be silently ignored. + * snmp: The SNMP manager now propagates msgAuthoritativeEngineID + and msgUserName from USM security parameters through to the + snmpm_user:handle_error/3 callback when an incoming message is + discarded due to an unknown EngineID + (usmStatsUnknownEngineIDs). + * eunit: Fixed EUnit {node, ...} instantiation by passing node + name (instead of pid) and restored net_kernel auto-start for + non-distributed nodes. + +------------------------------------------------------------------- Old: ---- OTP-28.4.1.tar.gz _constraints New: ---- OTP-28.5.0.4.tar.gz fix-reproducible-asn1.patch fix-reproducible-docs-time.patch fix-reproducible-erts-time.patch fix-reproducible-zip.patch ----------(New B)---------- New:- Fixes for reproducable builds * fix-reproducible-asn1.patch * fix-reproducible-docs-time.patch New: * fix-reproducible-asn1.patch * fix-reproducible-docs-time.patch * fix-reproducible-erts-time.patch New: * fix-reproducible-docs-time.patch * fix-reproducible-erts-time.patch * fix-reproducible-zip.patch New: * fix-reproducible-erts-time.patch * fix-reproducible-zip.patch - Refreshed the following patches ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ erlang.spec ++++++ --- /var/tmp/diff_new_pack.irayhy/_old 2026-08-20 16:15:18.925291710 +0200 +++ /var/tmp/diff_new_pack.irayhy/_new 2026-08-20 16:15:18.928291816 +0200 @@ -22,8 +22,17 @@ %if ! %{defined _fillupdir} %define _fillupdir %{_localstatedir}/adm/fillup-templates %endif + +# Docs broken on i586 +# https://github.com/erlang/otp/issues/11156 +%ifarch i586 +%define build_doc 0 +%else +%define build_doc 1 +%endif + Name: erlang -Version: 28.4.1 +Version: 28.5.0.4 Release: 0 Summary: General-purpose programming language and runtime environment License: Apache-2.0 @@ -40,6 +49,11 @@ Patch0: otp-R16B-rpath.patch # PATCH-FIX-OPENSUSE erlang-not-install-misc.patch - [email protected] -- patch from Fedora, this removes unneeded magic Patch4: erlang-not-install-misc.patch +# PATCH-FIX-OPENSUSE / SUSE - Reproducable builds support +Patch5: fix-reproducible-zip.patch +Patch6: fix-reproducible-erts-time.patch +Patch7: fix-reproducible-docs-time.patch +Patch8: fix-reproducible-asn1.patch BuildRequires: Mesa-devel BuildRequires: autoconf BuildRequires: dejavu-fonts @@ -100,12 +114,14 @@ node that sends and receives messages using the Diameter protocol as defined in RFC 6733. +%if %{build_doc} %package doc Summary: Erlang documentation Requires: %{name} = %{version} %description doc Documentation for Erlang. +%endif %package epmd Summary: Erlang Port Mapper daemon @@ -244,9 +260,7 @@ A Graphics System used to write platform independent user interfaces. %prep -%setup -q -n otp-OTP-%{version} -%patch -P 0 -p1 -b .rpath -%patch -P 4 -p1 +%autosetup -p1 -n otp-OTP-%{version} cp %{SOURCE9} . # enable dynamic linking for ssl @@ -270,11 +284,11 @@ --enable-smp-support \ --enable-kernel-poll \ --enable-shared-zlib -# clean stalled files before rebuild them -%make_build clean %make_build V=1 +%if %{build_doc} # to build the docs, just compiled erlang is required PATH=$PWD/bin:$PATH ERL_TOP=$TMP_ERL_TOP %make_build docs +%endif %sysusers_generate_pre %{SOURCE10} epmd epmd-user.conf @@ -283,8 +297,11 @@ #PATH=$PWD/bin:$PATH make test V=1 %install +%if %{build_doc} %make_install install-docs V=1 - +%else +%make_install V=1 +%endif export TOOLS_VERSION=`ls %{buildroot}%{_libdir}/erlang/lib/ |grep ^tools- | sed "s|tools-||"` # clean up @@ -294,12 +311,14 @@ find %{buildroot}%{_libdir}/erlang -type d -path '*/priv/obj' -exec rm -Rfv "{}" "+" find %{buildroot}%{_libdir}/erlang -name '.build' -exec rm -Rfv "{}" "+" +%if %{build_doc} # doc mkdir -p erlang_doc mv %{buildroot}%{_libdir}/erlang/doc ./erlang_doc find %{buildroot}%{_libdir}/erlang -maxdepth 4 -name info -or -type d -and -path '%{buildroot}%{_libdir}/**/doc/*' -and -not -name chunks -prune | while read S;do D=`echo $S | sed -e 's|%{buildroot}%{_libdir}/erlang|erlang_doc|'`; B=`dirname $D`; mkdir -p $B; mv $S $D; done # compress man pages ... find %{buildroot}%{_libdir}/erlang/man -type f -exec gzip {} + +%endif #make link to OtpErlang-*.jar in %%{_javadir} mkdir -p %{buildroot}%{_javadir} @@ -360,7 +379,9 @@ %exclude %{_bindir}/epmd %dir %{_libdir}/erlang %dir %{_libdir}/erlang/lib/ +%if %{build_doc} %exclude %{_libdir}/erlang/lib/*/doc/chunks +%endif %exclude %{_libdir}/erlang/lib/*/src %exclude %{_libdir}/erlang/lib/*/c_src %exclude %{_libdir}/erlang/lib/*/java_src @@ -429,8 +450,10 @@ %{_libdir}/erlang/lib/tools-*/* %dir %{_libdir}/erlang/lib/xmerl-*/ %{_libdir}/erlang/lib/xmerl-*/* +%if %{build_doc} %{_libdir}/erlang/man/ %{_mandir}/man1/*.1%{?ext_man} +%endif %{_libdir}/erlang/releases/ %dir %{_libdir}/erlang/usr/ %dir %{_libdir}/erlang/usr/include @@ -458,6 +481,7 @@ %{_libdir}/erlang/lib/diameter-*/* %exclude %{_libdir}/erlang/lib/diameter-*/src +%if %{build_doc} %files doc %defattr(0644,root,root,0755) %doc erlang_doc/* @@ -469,6 +493,7 @@ %exclude %{_libdir}/erlang/lib/reltool-*/doc/chunks %exclude %{_libdir}/erlang/lib/observer-*/doc/chunks %exclude %{_libdir}/erlang/lib/wx-*/doc/chunks +%endif %files et %dir %{_libdir}/erlang/lib/et-*/ ++++++ OTP-28.4.1.tar.gz -> OTP-28.5.0.4.tar.gz ++++++ /work/SRC/openSUSE:Factory/erlang/OTP-28.4.1.tar.gz /work/SRC/openSUSE:Factory/.erlang.new.1258/OTP-28.5.0.4.tar.gz differ: char 14, line 1 ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.irayhy/_old 2026-08-20 16:15:19.020295071 +0200 +++ /var/tmp/diff_new_pack.irayhy/_new 2026-08-20 16:15:19.026295283 +0200 @@ -1,6 +1,6 @@ -mtime: 1775400426 -commit: fd0270001c629b627ab1db1b49613e8a0dfbe22ba4f61142810969310a0ce6b3 -url: https://src.opensuse.org/erlang/erlang.git -revision: fd0270001c629b627ab1db1b49613e8a0dfbe22ba4f61142810969310a0ce6b3 +mtime: 1785909409 +commit: 54ade9f048a4d6116c311cd5590de80a65e40f8ac077a4abb146f318457561de +url: https://src.opensuse.org/erlang/erlang +revision: 54ade9f048a4d6116c311cd5590de80a65e40f8ac077a4abb146f318457561de projectscmsync: https://src.opensuse.org/erlang/_ObsPrj.git ++++++ build.specials.obscpio ++++++ --- old/.gitignore 2026-04-05 16:55:17.000000000 +0200 +++ new/.gitignore 2026-08-05 07:56:49.000000000 +0200 @@ -1 +1,3 @@ +*-build/ .osc +*.patch~ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-08-05 07:56:49.000000000 +0200 @@ -0,0 +1,3 @@ +*-build/ +.osc +*.patch~ ++++++ erlang-not-install-misc.patch ++++++ --- /var/tmp/diff_new_pack.irayhy/_old 2026-08-20 16:15:19.226302359 +0200 +++ /var/tmp/diff_new_pack.irayhy/_new 2026-08-20 16:15:19.231302536 +0200 @@ -3,11 +3,11 @@ Subject: [PATCH] Do not format man-pages and do not install miscellaneous utilities for dealing with man-pages. -Index: otp-OTP-23.0/erts/etc/common/Makefile.in +Index: otp-OTP-28.5.0.4/erts/etc/common/Makefile.in =================================================================== ---- otp-OTP-23.0.orig/erts/etc/common/Makefile.in -+++ otp-OTP-23.0/erts/etc/common/Makefile.in -@@ -521,10 +521,6 @@ endif +--- otp-OTP-28.5.0.4.orig/erts/etc/common/Makefile.in ++++ otp-OTP-28.5.0.4/erts/etc/common/Makefile.in +@@ -559,10 +559,6 @@ endif ifneq ($(INSTALL_TOP_BIN),) $(INSTALL_PROGRAM) $(INSTALL_TOP_BIN) "$(RELEASE_PATH)" endif @@ -18,11 +18,11 @@ ifneq ($(INSTALL_SRC),) $(INSTALL_DIR) "$(RELEASE_PATH)/erts-$(VSN)/src" $(INSTALL_DATA) $(INSTALL_SRC) "$(RELEASE_PATH)/erts-$(VSN)/src" -Index: otp-OTP-23.0/erts/etc/unix/Install.src +Index: otp-OTP-28.5.0.4/erts/etc/unix/Install.src =================================================================== ---- otp-OTP-23.0.orig/erts/etc/unix/Install.src -+++ otp-OTP-23.0/erts/etc/unix/Install.src -@@ -142,14 +142,5 @@ cp -p ../releases/%I_SYSTEM_VSN%/start_* +--- otp-OTP-28.5.0.4.orig/erts/etc/unix/Install.src ++++ otp-OTP-28.5.0.4/erts/etc/unix/Install.src +@@ -145,14 +145,5 @@ cp -p ../releases/%I_SYSTEM_VSN%/start_* cp -p ../releases/%I_SYSTEM_VSN%/no_dot_erlang.boot . cp -p $Name.boot start.boot cp -p ../releases/%I_SYSTEM_VSN%/$Name.script start.script ++++++ fix-reproducible-asn1.patch ++++++ >From 521670aff0afb168c9056c9b901102e139a6dfcf Mon Sep 17 00:00:00 2001 From: "Bernhard M. Wiedemann" <[email protected]> Date: Mon, 27 Jul 2026 15:17:48 +0200 Subject: [PATCH] public_key: Compile ASN.1 modules serially for reproducible output The ASN.1 compiler names anonymous parameterized-type/object-set arguments internal_object_set_argument_N using a global counter. How many instantiations run while checking a module depends on whether the checked .asn1db files of its imports already exist. The RFC 5912 modules import each other cyclically and the Makefile has no inter-module dependencies, so under make -jN the .asn1db availability is a race and atoms like getenc_internal_object_set_argument_2 vs _1 differ between builds. Serialize this directory to get a fixed order. Helps with issue #4417 This patch was done while working on reproducible builds for openSUSE. --- lib/public_key/asn1/Makefile | 6 ++++++ 1 file changed, 6 insertions(+) Index: otp-OTP-28.5.0.4/lib/public_key/asn1/Makefile =================================================================== --- otp-OTP-28.5.0.4.orig/lib/public_key/asn1/Makefile +++ otp-OTP-28.5.0.4/lib/public_key/asn1/Makefile @@ -106,6 +106,12 @@ endif # Targets # ---------------------------------------------------- +# The RFC 5912 modules import each other cyclically. Whether a sibling +# module's checked .asn1db exists when a module is compiled changes the +# numbering of generated internal_object_set_argument_N names, so the +# compilations must run in a fixed order for reproducible output. +.NOTPARALLEL: + $(TYPES): $(TARGET_FILES) $(HRL_FILES) clean: ++++++ fix-reproducible-docs-time.patch ++++++ >From 47a19aa1b3694c4218aa075c676d743571abe845 Mon Sep 17 00:00:00 2001 From: "Bernhard M. Wiedemann" <[email protected]> Date: Mon, 27 Jul 2026 15:13:28 +0200 Subject: [PATCH] docs: Use SOURCE_DATE_EPOCH for the copyright year in doc footers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The footer of every ex_doc-generated documentation page embeds the year of the build clock ("Copyright © 1996-<year> Ericsson AB"), making the erlang-doc package unreproducible when built at a different time. Honor the SOURCE_DATE_EPOCH environment variable (https://reproducible-builds.org/docs/source-date-epoch/) when set. Helps with issue #4417 This patch was done while working on reproducible builds for openSUSE. --- make/ex_doc.exs | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) Index: otp-OTP-28.5.0.4/make/ex_doc.exs =================================================================== --- otp-OTP-28.5.0.4.orig/make/ex_doc.exs +++ otp-OTP-28.5.0.4/make/ex_doc.exs @@ -177,7 +177,17 @@ extras = annotations = Access.get(local_config, :annotations_for_docs, fn _ -> [] end) -current_datetime = System.os_time() |> DateTime.from_unix!(:native) +current_datetime = + case System.get_env("SOURCE_DATE_EPOCH") do + nil -> + System.os_time() |> DateTime.from_unix!(:native) + + epoch -> + case Integer.parse(epoch) do + {seconds, ""} -> DateTime.from_unix!(seconds) + _ -> System.os_time() |> DateTime.from_unix!(:native) + end + end ## Check if we should treat warnings as errors warnings_as_errors = ++++++ fix-reproducible-erts-time.patch ++++++ >From 89a37f73a5c03bc0718ecb828dc745c6817ef2b4 Mon Sep 17 00:00:00 2001 From: "Bernhard M. Wiedemann" <[email protected]> Date: Mon, 27 Jul 2026 15:14:34 +0200 Subject: [PATCH] erts: Use SOURCE_DATE_EPOCH for the year in generated erl_alloc_types.h The make_alloc_types generator embeds the current year in the copyright header of the generated erl_alloc_types.h, which ends up in the debugsource package and varies with the build clock. Honor SOURCE_DATE_EPOCH when set. Helps with issue #4417 This patch was done while working on reproducible builds for openSUSE. --- erts/emulator/utils/make_alloc_types | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: otp-OTP-28.5.0.4/erts/emulator/utils/make_alloc_types =================================================================== --- otp-OTP-28.5.0.4.orig/erts/emulator/utils/make_alloc_types +++ otp-OTP-28.5.0.4/erts/emulator/utils/make_alloc_types @@ -190,7 +190,7 @@ print DST "/* * ----------------------------------------------------------------------- * * - * Copyright Ericsson AB ", (1900 + (localtime)[5]), ". All Rights Reserved. + * Copyright Ericsson AB ", (1900 + (localtime($ENV{SOURCE_DATE_EPOCH} || time))[5]), ". All Rights Reserved. * * Licensed under the Apache License, Version 2.0 (the \"License\"); * you may not use this file except in compliance with the License. ++++++ fix-reproducible-zip.patch ++++++ >From 13da01c35c6aa9245db51ea5f991019ec2989dc0 Mon Sep 17 00:00:00 2001 From: "Bernhard M. Wiedemann" <[email protected]> Date: Mon, 27 Jul 2026 14:57:30 +0200 Subject: [PATCH] stdlib: Use SOURCE_DATE_EPOCH for in-memory zip entries zip:create/2,3 stamps entries created from in-memory binaries with the current local time. This makes every archive built from binaries, in particular escripts created by escript:create/2 and Elixir's mix escript.build (e.g. the rabbitmq-server escripts), unreproducible. Honor SOURCE_DATE_EPOCH when set. See https://reproducible-builds.org/ for why this is good and https://reproducible-builds.org/specs/source-date-epoch/ for the definition of this variable. Helps with issue #4417 This patch was done while working on reproducible builds for openSUSE. --- lib/stdlib/src/zip.erl | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) Index: otp-OTP-28.5.0.4/lib/stdlib/src/zip.erl =================================================================== --- otp-OTP-28.5.0.4.orig/lib/stdlib/src/zip.erl +++ otp-OTP-28.5.0.4/lib/stdlib/src/zip.erl @@ -2686,7 +2686,13 @@ binary_io({file_info, B}, _) -> is_binary(B) -> {regular, byte_size(B)}; B =:= directory -> {directory, 0} end, - Now = calendar:local_time(), + Now = case os:getenv("SOURCE_DATE_EPOCH") of + false -> + calendar:local_time(); + Epoch -> + calendar:system_time_to_local_time( + list_to_integer(Epoch), second) + end, #file_info{size = Size, type = Type, access = read_write, atime = Now, mtime = Now, ctime = Now, mode = ++++++ otp-R16B-rpath.patch ++++++ --- /var/tmp/diff_new_pack.irayhy/_old 2026-08-20 16:15:19.342306463 +0200 +++ /var/tmp/diff_new_pack.irayhy/_new 2026-08-20 16:15:19.346306605 +0200 @@ -1,8 +1,6 @@ -Index: otp-OTP-24.0/lib/crypto/c_src/Makefile.in -=================================================================== ---- otp-OTP-24.0.orig/lib/crypto/c_src/Makefile.in -+++ otp-OTP-24.0/lib/crypto/c_src/Makefile.in -@@ -136,7 +136,7 @@ endif +--- a/lib/crypto/c_src/Makefile.in ++++ b/lib/crypto/c_src/Makefile.in +@@ -149,7 +149,7 @@ endif endif ifeq ($(DYNAMIC_OR_WIN_CRYPTO_LIB),yes)
