Bug#985335: cdebootstrap: please make the build reproducible

[Jochen Sprickerhof]

Hi Vagrant,

* Vagrant Cascadian <vagr...@reproducible-builds.org> [2026-09-24 12:33]:

On 2026-07-10, Jochen Sprickerhof wrote:

* Chris Lamb <la...@debian.org> [2021-03-16 09:19]:

Whilst working on the Reproducible Builds effort [0] we noticed that
cdebootstrap could not be built reproducibly.

This is the because the embedded .tar file does not sort its entries
so it inherits the (non-deterministic) filesystem ordering.

Patch attached that adds --sort=name (next to --mtime=[..]) that makes
the build reproducible for me locally.

...

--- a/debian/rules      2021-03-16 08:54:17.949083106 +0000
--- b/debian/rules      2021-03-16 08:58:39.291962035 +0000
@@ -38,7 +38,7 @@

        dh_auto_install --builddir build-tar --destdir debian/tmp
        strip --remove-section=.comment --remove-section=.note 
debian/tmp/usr/bin/cdebootstrap
-       tar -C debian/tmp/usr/bin --mtime=@$(SOURCE_DATE_EPOCH) -cf 
debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar .
+       tar -C debian/tmp/usr/bin --sort=name --mtime=@$(SOURCE_DATE_EPOCH) -cf 
debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar .
        mkdir -p debian/cdebootstrap-static/usr/lib/cdebootstrap
        cp debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar 
debian/cdebootstrap-static/usr/lib/cdebootstrap

I have just tested this and it makes the package reproducible for me. Is
there anything blocking the integration of this?

This also requires passing "--owner=0 --group=0 --numeric-owner" to tar

Good point. I had missed that because sbuild always uses a fixed username nowadays so it is less important but still a good idea.

in debian/rules and setting "Rules-Requires-Root: binary-targets" in
debian/control, otherwise the username, groupname and user id and group
id also get embedded in both the tarball:

Cheers Jochen

I don't see a need for that and I just tested the change without and build is fine and autopkgtest runs without problem. As we only change a tar call I don't think there is a need. In general we try to avoid R³ binary-targts as it makes reproducing much harder and in case there is a need debputy should be the better option.

signature.asc
Description: PGP signature