Your message dated Fri, 09 Dec 2016 01:33:37 +0000
with message-id <[email protected]>
and subject line Bug#794014: fixed in moin 1.9.9-1
has caused the Debian Bug report #794014,
regarding moin: please make the build reproducible
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
794014: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=794014
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: moin
Version: 1.9.8-1
Severity: wishlist
Tags: patch
User: [email protected]
Usertags: timestamps
X-Debbugs-Cc: [email protected]
Hi,
While working on the "reproducible builds" effort [1], we have noticed
that moin could not be built reproducibly.
The attached patch normalizes the timezone and fixes timestamps from the
files compressed with zip to a known value (timestamp from the last
debian/changelg entry). Once applied, moin can be built
reproducibly in our current experimental framework.
[1]: https://wiki.debian.org/ReproducibleBuilds
Regards,
--
Dhole
diff -Nru moin-1.9.8/debian/changelog moin-1.9.8/debian/changelog
--- moin-1.9.8/debian/changelog 2014-10-19 02:40:50.000000000 +0200
+++ moin-1.9.8/debian/changelog 2015-07-29 16:43:54.000000000 +0200
@@ -1,3 +1,10 @@
+moin (1.9.8-1.1) UNRELEASED; urgency=medium
+
+ * Non-maintainer upload.
+ * Fix timestamps to make package build reproducibly.
+
+ -- Eduard Sanou <[email protected]> Wed, 29 Jul 2015 16:43:35 +0200
+
moin (1.9.8-1) unstable; urgency=medium
* New upstream release, lots of bug fixes
diff -Nru moin-1.9.8/debian/process_language_pages
moin-1.9.8/debian/process_language_pages
--- moin-1.9.8/debian/process_language_pages 2014-10-19 01:09:03.000000000
+0200
+++ moin-1.9.8/debian/process_language_pages 2015-07-29 21:48:18.000000000
+0200
@@ -24,7 +24,7 @@
echo "Cleaning comments in $f"
tmp=`mktemp -d --tmpdir=$BASE` || exit 2
cd $tmp
- unzip -q $f
+ TZ=UTC unzip -q $f
chmod a+rw ./*
egrep -r -l -Z '^## ' * \
| xargs -r -0 -n 1 \
@@ -32,8 +32,11 @@
# ^^ search and drop notes in the 8 first lines.
chmod a-w ./*
chmod a+w MOIN_PACKAGE
+ # Fix files mtime before compressing to get reproducible results.
+ find . -newermt "$(date -u -d @$SOURCE_DATE_EPOCH)" -print0 | \
+ xargs -0r touch --no-dereference --date="$(date -u -d
@$SOURCE_DATE_EPOCH)"
rm $f
- zip -q $f *
+ TZ=UTC zip -X -q $f *
cd $BASE
rm -Rf $tmp
COUNT=$(($COUNT + 1))
diff -Nru moin-1.9.8/debian/rules moin-1.9.8/debian/rules
--- moin-1.9.8/debian/rules 2014-10-19 01:09:03.000000000 +0200
+++ moin-1.9.8/debian/rules 2015-07-29 19:00:17.000000000 +0200
@@ -8,6 +8,8 @@
staticpath := $(shell sed -n -e
"s|^\s*release_short\s*=\s*'\([^']*\)'.*|/moin_static\1|p" MoinMoin/version.py)
$(if $(staticpath),,$(error Failed to resolve staticpath))
+export SOURCE_DATE_EPOCH = $(shell date -d "$$(dpkg-parsechangelog --count 1
-SDate)" +%s)
+
build-arch build-indep: build-stamp
build-stamp:
dh_testdir
signature.asc
Description: OpenPGP digital signature
--- End Message ---
--- Begin Message ---
Source: moin
Source-Version: 1.9.9-1
We believe that the bug you reported is fixed in the latest version of
moin, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Steve McIntyre <[email protected]> (supplier of updated moin package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Thu, 8 Dec 2016 22:13:08 +0000
Source: moin
Binary: python-moinmoin
Architecture: source all
Version: 1.9.9-1
Distribution: unstable
Urgency: medium
Maintainer: Steve McIntyre <[email protected]>
Changed-By: Steve McIntyre <[email protected]>
Description:
python-moinmoin - Python clone of WikiWiki - library
Closes: 794014 844338 844340 844341
Changes:
moin (1.9.9-1) unstable; urgency=medium
.
* New upstream release, lots of bug fixes
* Includes a few security updates:
+ CVE-2016-9119: XSS in GUI editor's link dialogue
(Closes: #844338)
+ CVE-2016-7146: XSS in GUI editor's attachment dialogue
(Closes:#844340)
+ CVE-2016-7148: XSS in AttachFile view (multifile related)
(Closes: #844341)
* Apply recommended patch from upstream: fix wrong digestmod of hmac.new
calls
* Update patches to fit upstream changes:
+ use_systemwide_libs.patch
+ mail-verification.patch
* Add patch from Paul Wise to implement an incremental dump process in
moin dump
* Fix timestamps to make package build reproducibly. Thanks to Eduard
Sanou for the patch. Closes: #794014
Checksums-Sha1:
c5b52bbc46da4d278b4e992505ea00dac944c8d3 1851 moin_1.9.9-1.dsc
d582126c443939cb09e650eeddd677ed7e8c3f99 37206341 moin_1.9.9.orig.tar.gz
fe32d0193d51e5a7d46a10a7fc2dc6960162cdd0 151888 moin_1.9.9-1.debian.tar.xz
36f5edd96dc9973173c31a4cf1b9be163891f6bf 5334 moin_1.9.9-1_amd64.buildinfo
aa34148e565c69e16d8e3445c996a7741316bd57 7982778
python-moinmoin_1.9.9-1_all.deb
Checksums-Sha256:
c7da8347baee23ffec9b0a8fa94705aa4d0cfabf5bd9b06d53e07dff77ac938f 1851
moin_1.9.9-1.dsc
4397d7760b7ae324d7914ffeb1a9eeb15e09933b61468072acd3c3870351efa4 37206341
moin_1.9.9.orig.tar.gz
36ffe07570ace5c281d62e9d507265344a28159bf05e1c800261d9ad450cd76a 151888
moin_1.9.9-1.debian.tar.xz
3389ae6d68002699dbd00df498002d1d8e054fc9d2b55b1027547094c9a4cc2c 5334
moin_1.9.9-1_amd64.buildinfo
a94b14db49c274684ef4775edff82c2e4658e7946ee251565ae98c8eb1d6ded0 7982778
python-moinmoin_1.9.9-1_all.deb
Files:
dc3ec3f28992c14532b7f54c04af21df 1851 net optional moin_1.9.9-1.dsc
32f02a5d0df06b80d889ca6cdc51593e 37206341 net optional moin_1.9.9.orig.tar.gz
62a970dbcd97797d8a2320144b74f930 151888 net optional moin_1.9.9-1.debian.tar.xz
10676e0532049269ef40da0a36369cf4 5334 net optional moin_1.9.9-1_amd64.buildinfo
a747ee0d9e279a5e35e6f21557c23933 7982778 python optional
python-moinmoin_1.9.9-1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJYSgRXAAoJEFh5eVc0QmhOCigP/1OCin2RmTpWLW/+exrnVruC
Xpu+X3RLxSl9b0qaRJRj992rwUWkS21tEMuLaxmaLcuUbOecC0nJljiVJ1ZpKykt
kLyNmiYT/n+D4UywFhoc19CFPTF3scF0WKpvGVnSqw29GEQYK7xbi6WXyKKtgMUm
sgdEAO5trAGMdcqMIpUs6FNDNkBJo3nNW+mj4opDxBHuDG5/4XirZEYUvKlHrnAF
G6dwheEjlUMYfgMBbMN81fcR313JXEKM2hGwtR/MPf4XlpNmijOBNgNYYcaVn6Yu
9RXO3BhjR9mPy1OBkzrkTlOMtL9H4OSe/oYGM9jZA6y7jLO7u0zPG7aW2JL0LU8L
ZozzxPwB1T80I07Nrb0Jd/Yo5EsCwnLwDOX3diOrl+6q7PIgA78qE4+eGmQI3Y5Q
tu0s+t2Fg9FhaiK5rehb/KYuoQi1Meeomrw04vILYf8vfK4TD681XzxcsYuTxSg7
2Fff9BrMojZlpuyOpSrj4PovDTG7wO2TmigrloToLylO31IAR2GHntTGgY1iJ9RF
HniQGQOGOayxD7FvEoRh6SfMdCaD+sVyT0bdbR7L1OGyRYQtLYHygNfie3onIWxF
salZP+fZWh76mKj4x+bFyJRWIO9US4V+WPF7e9SXVcW8MpN4I5COVKweNqwAvXQv
fUYeXGKd9Uggx8aaxz9i
=85fC
-----END PGP SIGNATURE-----
--- End Message ---
