Package: libical-dev
Version: 1.0-1.1
Severity: critical
Usertags: randomness


While working on the “reproducible builds” effort [1], we have noticed
that libical could not be built reproducibly:

The debbindiff output linked above show that two builds of libical will
output different values for the constant defined in the icalvalue_kind
enum in ical.h and icalderivedvalue.h.

This is bad. It means that any software using these values will break
when libical is updated. After a quick look at the report, this might be
the cause for #766454.

The problem highly likely lies in the following code:
Sorting the keys before using them should make the output stable accross
builds. Ideally this should be done in all similar constructs to enable
the package to build reproducibly.

Packages having a Build-Depends on libical-dev should probably be
binNMU'ed once this is fixed. That should be:, asterisk,
bluez, cairo-dock-plug-ins, citadel, cyrus-imapd-2.4, evolution,
evolution-data-server, evolution-ews, gnokii, goldencheetah, ical2html,
kdepimlibs, kmymoney, libsynthesis, openchange, orage, osmo,
syncevolution, webcit.


Lunar                                .''`.                    : :Ⓐ  :  # apt-get install anarchism
                                    `. `'` 

Attachment: signature.asc
Description: Digital signature

Reproducible-builds mailing list

Reply via email to