On 2026-09-24, Vagrant Cascadian wrote:
> On 2026-04-30, Chris Lamb wrote:
>> Whilst working on the Reproducible Builds effort [0], we noticed that
>> ruby-timers could not be built reproducibly.
>>
>> This is because the .gemspec file gets evaluated, causing this line:
>>
>> File.expand_path("~/.gem/release.pem")
>>
>> ... to be rendered in the binary package, leading to the package
>> embedding the build user's home directory.
>>
>> Patch attached.
>
> I can confirm that the patch still applies and fixes the issue.
>
> I would like to perform a Non-Maintainer Upload (NMU) in the coming
> weeks applying this patch.I have uploaded an NMU to DELAYED/10, debdiff attached. Also prepared a merge request: https://salsa.debian.org/ruby-team/ruby-timers/-/merge_requests/1 live well, vagrant
diff -Nru ruby-timers-4.4.0/debian/changelog ruby-timers-4.4.0/debian/changelog --- ruby-timers-4.4.0/debian/changelog 2026-02-08 18:24:40.000000000 -0800 +++ ruby-timers-4.4.0/debian/changelog 2026-10-14 14:39:23.000000000 -0700 @@ -1,3 +1,13 @@ +ruby-timers (4.4.0-2.1) unstable; urgency=medium + + * Non-maintainer upload. + + [ Chris Lamb ] + * debian/patches: timers.gemspec: Drop cert_chain and signing_key for + reproducible builds. (Closes: #1135269) + + -- Vagrant Cascadian <[email protected]> Wed, 14 Oct 2026 14:39:23 -0700 + ruby-timers (4.4.0-2) unstable; urgency=medium * Team upload. diff -Nru ruby-timers-4.4.0/debian/patches/0001-timers.gemspec-Drop-cert_chain-and-signing_key-for-r.patch ruby-timers-4.4.0/debian/patches/0001-timers.gemspec-Drop-cert_chain-and-signing_key-for-r.patch --- ruby-timers-4.4.0/debian/patches/0001-timers.gemspec-Drop-cert_chain-and-signing_key-for-r.patch 1969-12-31 16:00:00.000000000 -0800 +++ ruby-timers-4.4.0/debian/patches/0001-timers.gemspec-Drop-cert_chain-and-signing_key-for-r.patch 2026-10-14 14:35:41.000000000 -0700 @@ -0,0 +1,27 @@ +From cd272bbe224bb6a0043b9ac13f36932134bddb74 Mon Sep 17 00:00:00 2001 +From: Chris Lamb <[email protected]> +Date: Thu, 30 Apr 2026 13:09:31 -0700 +Subject: [PATCH] timers.gemspec: Drop cert_chain and signing_key for + reproducible builds. (Closes: #1135269) + +--- + timers.gemspec | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/timers.gemspec b/timers.gemspec +index c96a9b0..967b2b2 100644 +--- a/timers.gemspec ++++ b/timers.gemspec +@@ -10,9 +10,6 @@ Gem::Specification.new do |spec| + spec.authors = ["Tony Arcieri", "Samuel Williams", "Donovan Keme", "Wander Hillen", "Utenmiki", "Jeremy Hinegardner", "Sean Gregory", "Chuck Remes", "Olle Jonsson", "Ron Evans", "Tommy Ong Gia Phu", "Larry Lv", "Lin Jen-Shin", "Ryunosuke Sato", "Atul Bhosale", "Bruno Enten", "Dimitrij Denissenko", "Jesse Cooke", "Klaus Trainer", "Lavir the Whiolet", "Mike Bourgeous", "Nicholas Evans", "Patrik Wenger", "Peter Goldstein", "Ryan LeCompte", "Tim Smith", "Vít Ondruch", "Will Jessop", "Yoshiki Takagi"] + spec.license = "MIT" + +- spec.cert_chain = ["release.cert"] +- spec.signing_key = File.expand_path("~/.gem/release.pem") +- + spec.homepage = "https://github.com/socketry/timers"; + + spec.metadata = { +-- +2.47.3 + diff -Nru ruby-timers-4.4.0/debian/patches/series ruby-timers-4.4.0/debian/patches/series --- ruby-timers-4.4.0/debian/patches/series 1969-12-31 16:00:00.000000000 -0800 +++ ruby-timers-4.4.0/debian/patches/series 2026-10-14 14:34:54.000000000 -0700 @@ -0,0 +1 @@ +0001-timers.gemspec-Drop-cert_chain-and-signing_key-for-r.patch
signature.asc
Description: PGP signature
