Your message dated Tue, 03 Nov 2026 04:34:42 +0000
with message-id <[email protected]>
and subject line Bug#1152419: fixed in nco 5.4.2-1
has caused the Debian Bug report #1152419,
regarding nco: build user and host name embedded in libnco make builds
unreproducible
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1152419: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1152419
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: nco
Version: 5.4.1-1
Severity: wishlist
Tags: patch upstream
Forwarded: https://github.com/nco/nco/pull/324
User: [email protected]
Usertags: hostname username
X-Debbugs-Cc: [email protected]
Hi,
configure.ac records the build user ($USER, else $LOGNAME) and host
name ($HOSTNAME, else $HOST) in config.h, and libnco embeds both:
"ncks --version" prints them (the amd64 package in unstable says
"built by sbuild on sbuild"), and the grid, skeleton, map, UGRID and
TERRAREF writers put the user name in the created_by attribute. A build
by another user or on another host therefore produces a different
libnco-5.4.1.so.
The reproducible-builds CI varies both and lists 5.4.1-1 as
unreproducible; its diff shows the two user names and host names in
libnco [1]. reproduce.debian.net does rebuild the official amd64 binary
bit for bit [2], presumably because its rebuild uses the same "sbuild"
names. The .buildinfo records neither value.
To reproduce (configure takes both values from the environment when
they are set):
dpkg-source -x nco_5.4.1-1.dsc && cd nco-5.4.1
USER=alice HOSTNAME=host-a DEB_BUILD_OPTIONS=nocheck
dpkg-buildpackage -b -us -uc
mv ../nco_5.4.1-1_amd64.deb ../nco-host-a.deb
USER=bob HOSTNAME=host-b DEB_BUILD_OPTIONS=nocheck dpkg-buildpackage
-b -us -uc
cmp ../nco-host-a.deb ../nco_5.4.1-1_amd64.deb
What I tested, in a sid chroot (dpkg 1.23.11, debhelper 14.5,
autoconf 2.73-2, gcc-16 16.2.0-4), with dpkg-buildpackage run as
non-root users and DEB_BUILD_OPTIONS=nocheck:
* The commands above: the two packages differ; config.h records
alice/host-a and bob/host-b.
* Unpatched, changing only USER/LOGNAME (same uid), or only the host
name, changes both nco and nco-dbgsym. In nco, the only differing
file is usr/lib/nco/libnco-5.4.1.so (and therefore md5sums).
* With the attached patch added as debian/patches/<patch> plus a
series file, and no other change, two builds from the resulting
source package (dpkg-source -b) that differed in user and uid, host
name, build path, LANG, time zone (UTC vs UTC+14), parallel= and
uname gave identical packages:
nco_5.4.1-1_amd64.deb
aec58fac88295e44e85a88e76984813e9a7fbd77bfee88acfa144f8b5a65b93d
nco-dbgsym_5.4.1-1_amd64.deb
a4298c2dc0565a4ab31497dd36eae6a7bde4392cd5df6f20714025b3837fefee
dh_autoreconf regenerates configure from the patched configure.ac.
Three earlier builds of the same change (it differed only in a code
comment), and three with the debian/rules alternative below, gave
the same two hashes.
* bm/nco_bm.pl --regress against the installed package: 486 tests,
474 pass, 12 fail, with the same per-test results unpatched and
patched (the patched run used the byte-identical package from the
debian/rules alternative).
The patch is the configure.ac change I proposed upstream [3], not yet
reviewed there (upstream also gets the regenerated configure; here
dh_autoreconf regenerates it). When SOURCE_DATE_EPOCH is set and
non-empty, which dpkg-buildpackage ensures, configure records "nobody"
and "nowhere" (its existing fallbacks); builds without it are
unchanged. Visible effect in the package: "ncks --version" says "built
by nobody on nowhere", and created_by becomes "nobody" instead of
"sbuild". The patch can be dropped once an upstream release includes
it.
If you would rather not carry an upstream change, pinning the values in
debian/rules gives the same package hashes (tested):
override_dh_auto_configure:
USER=nobody HOSTNAME=nowhere dh_auto_configure -- \
(existing arguments unchanged)
Unexporting USER and HOSTNAME is not enough: configure re-executes
itself under bash, which sets HOSTNAME from the system host name when
it is not in the environment.
[1] https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/nco.html
[2] https://reproduce.debian.net/amd64/api/v0/pkgs/list?name=nco
(5.4.1-1: GOOD)
[3] https://github.com/nco/nco/pull/324
Regards,
Zackary Loevseth
0001-configure-do-not-record-build-user-and-host-when-SOURCE_DATE_EPOCH-is-set.patch
Description: Binary data
--- End Message ---
--- Begin Message ---
Source: nco
Source-Version: 5.4.2-1
Done: Bas Couwenberg <[email protected]>
We believe that the bug you reported is fixed in the latest version of
nco, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Bas Couwenberg <[email protected]> (supplier of updated nco package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 03 Nov 2026 05:13:13 +0100
Source: nco
Architecture: source
Version: 5.4.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian GIS Project <[email protected]>
Changed-By: Bas Couwenberg <[email protected]>
Closes: 1152419
Changes:
nco (5.4.2-1) unstable; urgency=medium
.
* New upstream release.
(closes: #1152419)
Checksums-Sha1:
39a0417a78460a3fc4725e0747070ca9c009e112 2029 nco_5.4.2-1.dsc
0935eee712a39bf15e05975e23e866c7b338a484 6927557 nco_5.4.2.orig.tar.gz
6db96b3381daa725da0b4cdc6e0a5ff91f37dcb3 13224 nco_5.4.2-1.debian.tar.xz
925541ee3dea0db1ebc9cedc7e886269b72acd76 11569 nco_5.4.2-1_amd64.buildinfo
Checksums-Sha256:
7602911aca7d4b44c4f0495d725f6e40628ea92122e1d333a01c7d0cc036d49c 2029
nco_5.4.2-1.dsc
082a483ec08a8afe91a645cc2fcabae01c2070ae0cec9218c4ad43760dae4e5c 6927557
nco_5.4.2.orig.tar.gz
c2ab6c4c4b7cb296cf0adf95668856c7bb47ca0daf24d9b572147c8dcb27c2b5 13224
nco_5.4.2-1.debian.tar.xz
4408e2612fc25a9eee756e4735f1290d5bd64a50dbbf40f58554c196a74d8545 11569
nco_5.4.2-1_amd64.buildinfo
Files:
12780a16d30e57900ea4ae3621607b11 2029 science optional nco_5.4.2-1.dsc
5b4c4877cd194180346738f3f44f7b58 6927557 science optional nco_5.4.2.orig.tar.gz
eee6f599fed7e92339e9d8b251439569 13224 science optional
nco_5.4.2-1.debian.tar.xz
60f441fdf72129cbca1c9bb642dbbd2b 11569 science optional
nco_5.4.2-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEgYLeQXBWQI1hRlDRZ1DxCuiNSvEFAmrpYD8ACgkQZ1DxCuiN
SvEiFQ/+N2cWD7JesN7kVLqQVHfnqvWodNNsmQkhJMKKjyp61rYjZWGMXuZM+84K
EQ7WYlvdxBr8gcQUCGrGZe3Xw993IXUr+NVaUtdd8FuvHrHrvSVzAMjYZlDJGrqN
4S65LndI7hvOv10S7kfpsXhGUvNrr4XAaHLcw9i0Q0KctVML6wxk4oixCZhNWEHO
+P5SVPeitVHtS61V9k7Ne0Ldz0M/WpsPfelKGK8cjzml4OR0V6OjameRC6D7lNhG
pumN0N5P4uGNsrGYO/49Q/ocSVdKgReZthp7mnxoEYBpRBguSwcwUSKEsi6dXxFW
aTbsY0WY8q4h0o+o+a0ms5QNglkOTEnuw2PULDDGxf0JVaOY/utpuwVRZEye3HjU
cpF9YXO0/xz0YEHhGx+MN+2bn5CIl+Z1k6CZxIZ1Zq1nzpfzigycW+91tWvxa9bl
WvyX5RhanrMNhWUVvZzkQ6qTCWkTpxasNu5yH1+ZIpamK4IOmXyF8COE4+El1YAJ
5pvEGvdlPyvWtdPoymzdGdLmtztbFJGYS/g0vsy0WAJ/r+mVQRK/UA8L2jfUQRmc
B3weEnjx+9xTTnZT9h1wrGbwwXD9Ba2z+Q9kLtrgsxE+8ErdWPVF+zDa5x+wvndT
XQP4BJTyhQaue36Cs7ZByIlwN8Zv/eMEIoczmCqspbrNE4tHJSc=
=moVq
-----END PGP SIGNATURE-----
pgp2H100X5Fmp.pgp
Description: PGP signature
--- End Message ---
_______________________________________________
Pkg-grass-devel mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-grass-devel
