Source: win32-loader
Version: 0.7.9
Severity: wishlist
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: timestamps

Hi!

While working on the “reproducible builds” effort [1], we have noticed
that win32-loader could not be built reproducibly.

The attached patch—based on Git master—fixes timestamps related
variations from the build system. Once applied, win32-loader can be
built reproducibly in our current experimental framework.

 [1]: https://wiki.debian.org/ReproducibleBuilds

-- 
Jérémy Bobbio                        .''`.
jeremy.bob...@irq7.fr               : :   :         lu...@debian.org
                                    `. `'`          lu...@torproject.org
                                      `-
From a204ef8b9f80fb5bde5b2f1d1d388a1f8ced3b26 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Bobbio?= <lu...@debian.org>
Date: Tue, 28 Apr 2015 17:51:57 +0000
Subject: [PATCH] Make package build reproducibly

All the issues were timestamps related. Here are the fixes:

First, we ask mingw to stop inserting timestamps when building NSIS DLLs.

Then, a date is used as the value of VIProductVersion. This now can be set
through a variable.

The modification time of the files that gets built to be embedded in the
installer gets written to the result. So these mtimes are now capped to the
build date.

Finally, the date is then set in debian/rules to the latest debian/changelog
entry to be the same accross builds.
---
 Makefile         | 13 ++++++++-----
 debian/changelog | 10 ++++++++++
 debian/rules     |  4 ++++
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/Makefile b/Makefile
index fc2330a..6145367 100644
--- a/Makefile
+++ b/Makefile
@@ -6,8 +6,10 @@ export SHELL := bash
 
 PACKAGE	:= win32-loader
 VERSION	:= $(shell head -n 1 debian/changelog | sed -e "s/^$(PACKAGE) (\(.*\)).*/\1/g")
+BUILD_DATE	?= $(shell LC_ALL=C date +'%a, %d %b %Y %T %z')
+FOUR_DIGITS_DATE	:= $(shell date -u +'%Y.%m.%d.%H%M' --date="$(BUILD_DATE)")
 
-NSIS_CC		:= i686-w64-mingw32-gcc -Os
+NSIS_CC		:= i686-w64-mingw32-gcc -Os -Xlinker --no-insert-timestamp
 NSIS_STRIP	:= i686-w64-mingw32-strip
 NSIS_CFLAGS	:= -Wl,--file-alignment,512 -Werror -D_WIN32_WINNT=0x0500
 
@@ -23,7 +25,7 @@ endif
 MAKENSIS	:= makensis -V3
 
 # Add to it some version'ing and date
-MAKENSIS	+= -DVERSION=$(VERSION) -D4DIGITS_DATE=`date +%Y.%m.%d.%H%M`
+MAKENSIS	+= -DVERSION=$(VERSION) -D4DIGITS_DATE=$(FOUR_DIGITS_DATE)
 
 ifdef OUTFILE_NAME
 MAKENSIS	+= -D_OUTFILE_NAME=$(OUTFILE_NAME)
@@ -111,9 +113,9 @@ pxe.lkrn: /usr/lib/ipxe/ipxe.lkrn
 	cp $^ $@
 
 ifdef PXE
-pxe.target: pxe.lkrn templates/ternary_choice.ini
+PXE_TARGETS = pxe.lkrn templates/ternary_choice.ini
 else
-pxe.target:
+PXE_TARGETS =
 endif
 
 templates/gtk.bmp: templates/gtk_orig.png
@@ -132,8 +134,9 @@ win32-loader.exe: main.nsi maps.ini \
 		templates/gtk.bmp templates/text.bmp \
 		plugins/cpuid/test64.dll plugins/systeminfo/systeminfo.dll plugins/string.dll \
 		plugins/sha1sum.dll \
-		pxe.target \
+		$(PXE_TARGETS) \
 		win32-loader.ico loadlin.pif loadlin.exe g2ldr g2ldr.mbr
+	find $^ -newermt "$(BUILD_DATE)" -print0 | xargs -0r touch --date="$(BUILD_DATE)"
 	$(MAKE) -C l10n
 	$(MAKENSIS) main.nsi
 ifndef OUTFILE_NAME
diff --git a/debian/changelog b/debian/changelog
index b7b4ba6..92bf432 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+win32-loader (0.7.9.0~reproducible1) UNRELEASED; urgency=low
+
+  * Make package build reproducibly:
+    - Don't insert timestamps when building NSIS DLLs.
+    - Allow to set build date externally.
+    - Reset embedded file modification times to the build date.
+    - Set build date in debian/rules to the latest debian/changelog entry.
+
+ -- Jérémy Bobbio <lu...@debian.org>  Tue, 28 Apr 2015 14:50:08 +0000
+
 win32-loader (0.7.9) unstable; urgency=medium
 
   * Add NSIS in the Built-Using list, given that win32-loader embeds (at least)
diff --git a/debian/rules b/debian/rules
index 0039893..352f819 100755
--- a/debian/rules
+++ b/debian/rules
@@ -3,6 +3,8 @@
 # Install the win32-loader-standalone.exe as debian/tools/win32-loader/$(SUITE)/win32-loader.exe on the mirrors
 BYHAND ?= yes
 
+BUILD_DATE := $(shell dpkg-parsechangelog -S Date)
+
 W32_VERSION := $(shell dpkg-parsechangelog | sed -rne 's,^Version: ([^-]+).*,\1,p')
 W32_BYHAND_NAME := win32-loader_$(W32_VERSION)_all
 
@@ -41,6 +43,7 @@ ifeq ($(BYHAND),yes)
 	STANDALONE=yes \
 		PXE=yes \
 		OUTFILE_NAME=$(W32_BYHAND_NAME).exe \
+		BUILD_DATE="$(BUILD_DATE)" \
 		dh_auto_build
 	
 	# Prepare the README file
@@ -52,6 +55,7 @@ ifeq ($(BYHAND),yes)
 endif
 	# Build the cdrom version
 	OUTFILE_NAME=win32-loader.exe \
+		BUILD_DATE="$(BUILD_DATE)" \
 		dh_auto_build
 
 override_dh_auto_clean:
-- 
2.1.4

Attachment: signature.asc
Description: Digital signature

_______________________________________________
Reproducible-builds mailing list
Reproducible-builds@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds

Reply via email to