On 2026-07-10, Jochen Sprickerhof wrote: > * Chris Lamb <[email protected]> [2021-03-16 09:19]: >>Whilst working on the Reproducible Builds effort [0] we noticed that >>cdebootstrap could not be built reproducibly. >> >>This is the because the embedded .tar file does not sort its entries >>so it inherits the (non-deterministic) filesystem ordering. >> >>Patch attached that adds --sort=name (next to --mtime=[..]) that makes >>the build reproducible for me locally. ... >>--- a/debian/rules 2021-03-16 08:54:17.949083106 +0000 >>--- b/debian/rules 2021-03-16 08:58:39.291962035 +0000 >>@@ -38,7 +38,7 @@ >> >> dh_auto_install --builddir build-tar --destdir debian/tmp >> strip --remove-section=.comment --remove-section=.note >> debian/tmp/usr/bin/cdebootstrap >>- tar -C debian/tmp/usr/bin --mtime=@$(SOURCE_DATE_EPOCH) -cf >>debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar . >>+ tar -C debian/tmp/usr/bin --sort=name --mtime=@$(SOURCE_DATE_EPOCH) -cf >>debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar . >> mkdir -p debian/cdebootstrap-static/usr/lib/cdebootstrap >> cp debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar >> debian/cdebootstrap-static/usr/lib/cdebootstrap
> I have just tested this and it makes the package reproducible for me. Is > there anything blocking the integration of this? This also requires passing "--owner=0 --group=0 --numeric-owner" to tar in debian/rules and setting "Rules-Requires-Root: binary-targets" in debian/control, otherwise the username, groupname and user id and group id also get embedded in both the tarball: https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/cdebootstrap.html ./usr/lib/cdebootstrap/cdebootstrap_0.7.9_amd64.tar drwxr-xr-x···0·pbuilder1··(1111)·pbuilder1··(1111)········0·2025-07-21·14:33:58.000000·./ vs. drwxr-xr-x···0·pbuilder2··(2222)·pbuilder2··(2222)········0·2025-07-21·14:33:58.000000·./ and the package metadata itself: ./usr/share/cdebootstrap/cdebootstrap-helper-rc.d.deb drwxr-xr-x···0·pbuilder1··(1111)·pbuilder1··(1111)········0·2025-07-21·14:33:58.000000·./ vs. drwxr-xr-x···0·pbuilder2··(2222)·pbuilder2··(2222)········0·2025-07-21·14:33:58.000000·./ I would like to perform an Non-Maintainer Upload to fix this issue in the following week or two; are there any outstanding concerns? In lieu of setting Rules-Requires-Root, possibly using a newer debhelper-compat version might also help... live well, vagrant
signature.asc
Description: PGP signature
