On 12/02/14 11:03, Jérémy Bobbio wrote: > Tomasz Buchert: > > The reason I did it is that I wanted to keep "backwards compatibility". > > Another solution is to drop "gzip-file-is-not-multi-arch-same-safe" > > altogether, of course. > > The latter is severity “important”. “Multi-Arch: Same” packages for > different architecture will be uninstallable if they do not contain > identical data files. That's a serious problem. Reproducibility issues > do not affect users in the same way. > > It could make sense to emit either “gzip-file-is-not-multi-arch-same-safe” or > “package-contains-timestamped-gzip” instead of emitting both as they > should be fixed by the same changes. > > -- > Jérémy Bobbio .''`. > jeremy.bob...@irq7.fr : : : lu...@debian.org > `. `'` lu...@torproject.org > `-
I wasn't aware of this. I updated the patch. Tomasz
>From b21b1dd328d6efb3b8e9d63e3c56e3ce3e0b2d8e Mon Sep 17 00:00:00 2001 From: Tomasz Buchert <tomasz.buch...@inria.fr> Date: Tue, 11 Feb 2014 10:11:20 +0100 Subject: [PATCH] new tag: package-contains-timestamped-gzip (+ test) --- checks/files.desc | 10 ++++++++++ checks/files.pm | 15 ++++++++++----- t/tests/files-reproducibility/debian/Makefile | 9 +++++++++ t/tests/files-reproducibility/desc | 6 ++++++ t/tests/files-reproducibility/tags | 1 + 5 files changed, 36 insertions(+), 5 deletions(-) create mode 100644 t/tests/files-reproducibility/debian/Makefile create mode 100644 t/tests/files-reproducibility/desc create mode 100644 t/tests/files-reproducibility/tags diff --git a/checks/files.desc b/checks/files.desc index 760f86a..f0b9444 100644 --- a/checks/files.desc +++ b/checks/files.desc @@ -1448,3 +1448,13 @@ Info: The given file is in PATH but consists of non-ASCII characters. . Note that Lintian may be unable to display the filename accurately. Unprintable characters may have been replaced. + +Tag: package-contains-timestamped-gzip +Severity: wishlist +Certainty: certain +Info: The package contains a gzip'ed file that has timestamps. + Such files make the packages unreproducible, because their + contents depend on the time when the package was built. + . + Please consider passing the "-n" flag to gzip to avoid this. +Ref: https://wiki.debian.org/ReproducibleBuilds diff --git a/checks/files.pm b/checks/files.pm index 5c5a60d..858d9f4 100644 --- a/checks/files.pm +++ b/checks/files.pm @@ -1400,23 +1400,28 @@ sub run { my $finfo = $info->file_info($file) || ''; if ($finfo !~ m/gzip compressed/) { tag 'gz-file-not-gzip', $file; - } elsif ($isma_same && $file !~ m/\Q$arch\E/o) { + } else { my $path = $info->unpacked($file); my $buff; + my $mtime; open(my $fd, '<', $path); # We need to read at least 8 bytes if (sysread($fd, $buff, 1024) >= 8) { # Extract the flags and the mtime. # NN NN NN NN, NN NN NN NN - bytes read # __ __ __ __, $mtime - variables - my (undef, $mtime) = unpack('NN', $buff); - if ($mtime){ - tag 'gzip-file-is-not-multi-arch-same-safe',$file; - } + (undef, $mtime) = unpack('NN', $buff); } else { fail "reading $file: $!"; } close($fd); + if ($mtime != 0) { + if ($isma_same && $file !~ m/\Q$arch\E/o) { + tag 'gzip-file-is-not-multi-arch-same-safe', $file; + } else { + tag 'package-contains-timestamped-gzip', $file; + } + } } } diff --git a/t/tests/files-reproducibility/debian/Makefile b/t/tests/files-reproducibility/debian/Makefile new file mode 100644 index 0000000..c5f6bc7 --- /dev/null +++ b/t/tests/files-reproducibility/debian/Makefile @@ -0,0 +1,9 @@ +ROOT=$(DESTDIR)/usr/share/files-reproducibility + +default: + : + +install: + mkdir -p $(ROOT) + echo "Hello" | gzip - -c > $(ROOT)/gzip-with-timestamp.gz + echo "Hello" | gzip - -nc > $(ROOT)/gzip-without-timestamp.gz diff --git a/t/tests/files-reproducibility/desc b/t/tests/files-reproducibility/desc new file mode 100644 index 0000000..8cbbae9 --- /dev/null +++ b/t/tests/files-reproducibility/desc @@ -0,0 +1,6 @@ +Testname: files-reproducibility +Sequence: 6000 +Version: 1.0 +Description: Test if package is reproducible +Test-For: + package-contains-timestamped-gzip diff --git a/t/tests/files-reproducibility/tags b/t/tests/files-reproducibility/tags new file mode 100644 index 0000000..150dd0a --- /dev/null +++ b/t/tests/files-reproducibility/tags @@ -0,0 +1 @@ +I: files-reproducibility: package-contains-timestamped-gzip usr/share/files-reproducibility/gzip-with-timestamp.gz -- 1.8.5.3