On 2026-09-30, Vagrant Cascadian wrote: > On 2026-09-25, Jochen Sprickerhof wrote: >> * Vagrant Cascadian <[email protected]> [2026-09-24 12:33]: >>>On 2026-07-10, Jochen Sprickerhof wrote: >>>> * Chris Lamb <[email protected]> [2021-03-16 09:19]: >>>>>Whilst working on the Reproducible Builds effort [0] we noticed that >>>>>cdebootstrap could not be built reproducibly. ... >>>in debian/rules and setting "Rules-Requires-Root: binary-targets" in >>>debian/control, otherwise the username, groupname and user id and group >>>id also get embedded in both the tarball: >> >> I don't see a need for that and I just tested the change without and >> build is fine and autopkgtest runs without problem. As we only change a >> tar call I don't think there is a need. > > Well, tests.reproducible-builds.org still shows differences in the > various package data.tar.gz, so it will continue to be unreproducible > there unless that part gets fixed: > > > https://tests.reproducible-builds.org/debian/rb-pkg/forky/amd64/diffoscope-results/cdebootstrap.html > > Less important, but my test setup also tests this... :) > > With a closer look, it only appears to be the directories in the > data.tar.gz, not the regular files... > >> In general we try to avoid R³ binary-targts as it makes reproducing much >> harder and in case there is a need debputy should be the better option. > > Open to other ideas of how to fix it properly. Might try to poke at this > a little more...
Ok, passing "dpkg-deb --root-owner-group" in helper/Makefile.am did the trick!
So, a complete patch that works for me:
diff --git a/debian/rules b/debian/rules
index deb2cfa..9742b75 100755
--- a/debian/rules
+++ b/debian/rules
@@ -38,7 +38,10 @@ override_dh_auto_install:
dh_auto_install --builddir build-tar --destdir debian/tmp
strip --remove-section=.comment --remove-section=.note
debian/tmp/usr/bin/cdebootstrap
- tar -C debian/tmp/usr/bin --mtime=@$(SOURCE_DATE_EPOCH) -cf
debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar .
+ tar -C debian/tmp/usr/bin --sort=name \
+ --owner=0 --group=0 --numeric-owner \
+ --mtime=@$(SOURCE_DATE_EPOCH) \
+ -cf debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar
.
mkdir -p debian/cdebootstrap-static/usr/lib/cdebootstrap
cp debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar
debian/cdebootstrap-static/usr/lib/cdebootstrap
diff --git a/helper/Makefile.am b/helper/Makefile.am
index 934e1e1..b9291b5 100644
--- a/helper/Makefile.am
+++ b/helper/Makefile.am
@@ -24,7 +24,7 @@ temp-%:
$(MAKE) -C $(PACKAGE) package DESTDIR=$(CURDIR)/temp-$(PACKAGE)
root-%:
- dpkg-deb -Zgzip --build temp-$(PACKAGE) $(PACKAGE).deb
+ dpkg-deb -Zgzip --root-owner-group --build temp-$(PACKAGE)
$(PACKAGE).deb
clean-local:
rm -rf $(foreach package,$(packages),temp-$(package))
I would like to perform a Non-Maintainer Upload (NMU) with this patch in
the coming weeks.
Any outstanding concerns?
live well,
vagrant
signature.asc
Description: PGP signature
