Source: python-marshmallow-sqlalchemy Severity: normal Tags: patch User: [email protected] Usertags: timestamps X-Debbugs-Cc: [email protected]
The build year is embedded in copyright statements in various .html documentation: https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/python-marshmallow-sqlalchemy.html /usr/share/doc/python-marshmallow-sqlalchemy-doc/html/_modules/index.html ······©Steven·Loria·and·contributors·2024. vs. ······©Steven·Loria·and·contributors·2023. I have attached two different patches with two different approaches to fix this issue. The first patch simply removes the year from the copyright assertions from docs/conf.py. I prefer this approach, as dynamically generating the copyright dates during the build is not correct behavior; no new copyrighted material was generated as a result of the building at a later date. The second patch instead adds support for using SOURCE_DATE_EPOCH in docs/conf.py to set the year. While this is sufficient to make it reproducible, this is still likely to embed a year which might not match the actual year of the copyrightable material. According to my local tests, applying either patch should make python-marshmallow-sqlalchemy build reproducibly on tests.reproducible-builds.org! Thanks for maintaining python-marshmallow-sqlalchemy! live well, vagrant
From fc5a046e539832b07de109e06cf72628caa782b2 Mon Sep 17 00:00:00 2001 From: Vagrant Cascadian <[email protected]> Date: Sat, 24 Jun 2023 16:07:00 -0700 Subject: [PATCH 1/5] docs/conf.py: Do not embed build year in documentation. This breaks reproducible builds and is inaccurate to assume the build year is when the copyrightable material was written. https://reproducible-builds.org/docs/timestamps/ --- docs/conf.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/conf.py b/docs/conf.py index 63fb79f..1213a62 100755 --- a/docs/conf.py +++ b/docs/conf.py @@ -29,7 +29,7 @@ issues_github_path = "marshmallow-code/marshmallow-sqlalchemy" source_suffix = ".rst" master_doc = "index" project = "marshmallow-sqlalchemy" -copyright = f"Steven Loria and contributors {dt.datetime.utcnow():%Y}" +copyright = f"Steven Loria and contributors" version = release = marshmallow_sqlalchemy.__version__ -- 2.39.2
From 1bde10344c233490e934c1a7a4014da569537707 Mon Sep 17 00:00:00 2001 From: Vagrant Cascadian <[email protected]> Date: Sat, 24 Jun 2023 16:17:59 -0700 Subject: [PATCH 3/5] doc/conf.py: if set, use SOURCE_DATE_EPOCH to set copyright year. The build date of the software shouldn't really have any bearing on the copyright dates, but by respecting SOURCE_DATE_EPOCH, it at least limits this to the last time something in the source was changed. https://reproducible-builds.org/specs/source-date-epoch/ --- docs/conf.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/conf.py b/docs/conf.py index 63fb79f..8374b75 100755 --- a/docs/conf.py +++ b/docs/conf.py @@ -1,5 +1,6 @@ from collections import OrderedDict import datetime as dt +import time import os import sys @@ -29,7 +30,10 @@ issues_github_path = "marshmallow-code/marshmallow-sqlalchemy" source_suffix = ".rst" master_doc = "index" project = "marshmallow-sqlalchemy" -copyright = f"Steven Loria and contributors {dt.datetime.utcnow():%Y}" +# Parse year using SOURCE_DATE_EPOCH, falling back to current time. +# https://reproducible-builds.org/specs/source-date-epoch/ +sourceyear=dt.datetime.utcfromtimestamp(int(os.environ.get('SOURCE_DATE_EPOCH', time.time()))).year +copyright = f"Steven Loria and contributors {sourceyear}" version = release = marshmallow_sqlalchemy.__version__ -- 2.39.2
signature.asc
Description: PGP signature
