Your message dated Mon, 29 Dec 2025 00:11:26 +0000
with message-id <[email protected]>
and subject line Bug#1121801: fixed in in-toto-golang 0.9.0+ds-5
has caused the Debian Bug report #1121801,
regarding in-toto-golang: please make the build reproducible
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1121801: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121801
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: in-toto-golang
Version: 0.9.0+ds-4
Severity: wishlist
Tags: patch
User: [email protected]
Usertags: nocheck
X-Debbugs-Cc: [email protected]
Hi,
Whilst working on the Reproducible Builds effort [0], we noticed that
in-toto-golang could not be built reproducibly.
This is because the call to remove verifylib_test.go was in the wrong
debian/rules target. Whilst it was in override_dh_auto_test, this target
is not called if the tests are skipped... meaning that if the tests
are *not* run, then the package contains this file.
Patch attached that moves this removal to the (unconditionally run)
execute_after_dh_auto_build target, which also makes the call to
dh_auto_test a little cleaner by not being required.
[0] https://reproducible-builds.org/
Regards,
--
,''`.
: :' : Chris Lamb
`. `'` [email protected] / chris-lamb.co.uk
`-
--- a/debian/rules 2025-12-02 11:35:21.008570260 -0800
--- b/debian/rules 2025-12-02 11:44:47.077356056 -0800
@@ -10,7 +10,7 @@
override_dh_strip_nondeterminism:
dh_strip_nondeterminism -Xfoo.tar.gz
-override_dh_auto_test:
+execute_after_dh_auto_build:
# === RUN TestInTotoVerifyPass/verifying_with_only_DSSE_metadata
# verifylib_test.go:95: layout has expired on '2023-06-03 13:25:20 +0000
UTC'
# --- FAIL: TestInTotoVerifyPass (0.04s)
@@ -19,4 +19,3 @@
# --- FAIL: TestInTotoVerifyPass/verifying_with_only_DSSE_metadata (0.00s)
# === RUN TestGetSummaryLink
rm -f
_build/src/github.com/in-toto/in-toto-golang/in_toto/verifylib_test.go
- dh_auto_test $(DH_BUILD_OPTS)
--- End Message ---
--- Begin Message ---
Source: in-toto-golang
Source-Version: 0.9.0+ds-5
Done: Simon Josefsson <[email protected]>
We believe that the bug you reported is fixed in the latest version of
in-toto-golang, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Simon Josefsson <[email protected]> (supplier of updated in-toto-golang
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 29 Dec 2025 00:43:30 +0100
Source: in-toto-golang
Architecture: source
Version: 0.9.0+ds-5
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <[email protected]>
Changed-By: Simon Josefsson <[email protected]>
Closes: 1121801
Changes:
in-toto-golang (0.9.0+ds-5) unstable; urgency=medium
.
[ Simon Josefsson ]
* Modernize Salsa CI
* Use watch v5
* Drop Rules-Requires-Root: no
* Standards-Version: 4.7.3
* Use dh-sequence-golang
* Bump debian/* copyright years
.
[ Chris Lamb ]
* Fix reproducibility (Closes: #1121801)
Checksums-Sha1:
0a49f011dbc62ed2aa8bed5dde1071cd3360212d 2802 in-toto-golang_0.9.0+ds-5.dsc
e7446ac1d67443e34ec36999a60886d0da86c091 4700
in-toto-golang_0.9.0+ds-5.debian.tar.xz
50c2f58430c553347ac7fb5ed5f98c83be9340d7 1239428
in-toto-golang_0.9.0+ds-5.git.tar.xz
63de8ab8f630e0913537e7f69fea5e5cc343f3ad 17175
in-toto-golang_0.9.0+ds-5_source.buildinfo
Checksums-Sha256:
8e46ff084593ee6fb18b48f4e90e3bf32c94102da4622d0f2529e4bafcad01ba 2802
in-toto-golang_0.9.0+ds-5.dsc
6960ab4773cad72d97dd761c434782388fcc51fb0eb4f997ecbf71c5430e661d 4700
in-toto-golang_0.9.0+ds-5.debian.tar.xz
11a9bf6169b0652bbb3a812e4c1788c1faa82e061b6b07f4fefd0abace154ede 1239428
in-toto-golang_0.9.0+ds-5.git.tar.xz
01959ac5cd6a31495f876c59969d8c28b91a0b5ff12dd4068eb5b5e38941fcec 17175
in-toto-golang_0.9.0+ds-5_source.buildinfo
Files:
680c5928bc1c03a9963b0f7460432e86 2802 golang optional
in-toto-golang_0.9.0+ds-5.dsc
1cba30835c52e5f1df42c80dfce8a29e 4700 golang optional
in-toto-golang_0.9.0+ds-5.debian.tar.xz
50e2752fc238f3a9329d6addf757c101 1239428 golang optional
in-toto-golang_0.9.0+ds-5.git.tar.xz
dff58de3a0aaed83d410b5abb3668ce5 17175 golang optional
in-toto-golang_0.9.0+ds-5_source.buildinfo
Git-Tag-Info: tag=a67dfbad94007d576b045c14e80ee5db595b5af3
fp=a3cc9c870b9d310abad4cf2f51722b08fe4745a2
Git-Tag-Tagger: Simon Josefsson <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmlRwWEACgkQYG0ITkaD
wHkZnRAAvwuvyFRvDMSbPobdcKGZQeQuCA4JFXq/HFvfxUpEt6X82aVjXIpkAx81
nDPoI+3YnL/qpRc5gZPxICF80yu5rk6ZbUjdL7MVsSq6Czk22ssAHFRDVmZPOA7L
p9b1Xld4P+NiMxAURBFdYkNwlTc3vDvBX+UVOgMqRlEaLgW1hpDm1TY4dx5e1nLU
e2e+UAZTetwTX/hrVP+jDxB72PQJ45b5XCYKO8r6xCBlc1toFOnT9e489t3VFAuV
IlZkoblFmWhff2EcGsVVoDRYLP9qCCDxkiai/Um2FjAEpYQCVa/tdwDdeVZQXLlg
wv7htzXTvta3b5FeJhG+Dns0141qu3BZLfS9f9Q0rC2f/iEkjVrCfN25NXXH8fg9
39JWwwXa8Do5E/KcbqfCd1YvZrTu7zYiPk6P8pKG4thTEolHsU+5OMf0WsP2tgXN
KDk+12Uxy/TsBqU271qk8G76Wp2JIU7YwmtnEYKY7hUSWA/GtEe9RKKqqsfkxLCT
vF/WPOBRTmJ523ToHsFZIQtdbKOE+vdOK96HkqqjKnWf+9wMrdQesegqkWMS3Czk
fYkueq/WLEm9kJF7XMxIJpqwqEc8Rnp8i6qs/j8CVSjie9+MAA3pzGv/CLmXJrus
mWwjYFNw2xc/iX77SSxgxOSgUD6mT/VXIc3VOQ68jG/q3AG5JI8=
=zAA8
-----END PGP SIGNATURE-----
pgpree1VXGRl2.pgp
Description: PGP signature
--- End Message ---
