Bug#774496: ncurses: please make ncurses build reproducibly
On 2015-01-03 15:47 +0100, Jérémy Bobbio wrote: Sven Joachim: I am not strictly opposed to your patch, but I think the problem should be tackled elsewhere, so that fewer packages need to be modified. In our experimental toolchain, packages built using `dh` will automatically call `dh_strip_nondeterminism`. Packages using `dh` are the 60% plateau you can see on: https://jenkins.debian.net/userContent/stats_pkg_state.png Since a few days, we are getting more packages considered reproducible as we moved generation of the .buildinfo files to dpkg-buildpackage instead of doing it as a dh stop. Have you considered filing a wishlist bug against binutils to build with --enable-deterministic-archives, so that ar and ranlib operate in deterministic mode by default? Yes. This is how we did the experiment in January last year: https://wiki.debian.org/ReproducibleBuilds/Rebuild20140126 During discussions at DebConf14, it was acknowledged that having `--enable-deterministic-archives` could break some build systems in subtle ways and that it would be better to do without. Unfortunately, I have never been able to get Matthias Klose's opinion on the matter. Apparently doko thinks that `--enable-deterministic-archives` is a good idea, since he implemented it in binutils 2.25-6. :-) Is there still anything I need to do in ncurses? Cheers, Sven -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#774496: ncurses: please make ncurses build reproducibly
Source: ncurses Version: 5.9+20140913-1 Severity: wishlist Tags: patch User: reproducible-bui...@lists.alioth.debian.org Usertags: timestamps Hi! While working on the “reproducible builds” effort [1], we have noticed that ncurses could not be built reproducibly. The attached patch will add calls to strip-nondeterminism on static libraries. Once applied, the package can be built reproducibly with our current experimental framework. I've initially tried to run `ar` in deterministic mode by passing ARFLAGS=Dcrv. Unfortunately, `ranlib` is called after `ar` and there doesn't seem to be a way to pass the `-D` flag to it, and so it will write a timestamp in the newly created index. [1]: https://wiki.debian.org/ReproducibleBuilds -- Lunar.''`. lu...@debian.org: :Ⓐ : # apt-get install anarchism `. `'` `- From 914efd4f2ca07ada794bc70e6ecc8eb39725303c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Bobbio?= lu...@debian.org Date: Sat, 3 Jan 2015 13:54:20 +0100 Subject: [PATCH] Call strip-nondeterminism on static libraries Static libraries will unfortunately contain timestamps, preventing the package to be built reproducibly. strip-nondeterminism will take care of normalizing the libraries. Passing 'Dcvr' as ARFLAGS to configure is unfortunately not enough. The build process also calls ranlib, and there doesn't seem to be a way to give it the '-D' flag. --- debian/control | 1 + debian/rules | 5 + 2 files changed, 6 insertions(+) diff --git a/debian/control b/debian/control index 5c32f76..2cbbd67 100644 --- a/debian/control +++ b/debian/control @@ -9,6 +9,7 @@ Build-Depends: debhelper (= 8.1.3), libgpm-dev [linux-any], pkg-config, autotools-dev, + strip-nondeterminism, Standards-Version: 3.9.5 Vcs-Browser: http://anonscm.debian.org/gitweb/?p=collab-maint/ncurses.git Vcs-Git: git://anonscm.debian.org/collab-maint/ncurses.git diff --git a/debian/rules b/debian/rules index 1c0bc1a..924e7dd 100755 --- a/debian/rules +++ b/debian/rules @@ -344,6 +344,11 @@ install: build dh_testroot dh_prep + find $(objdir) $(objdir-static) $(objdir-32) $(objdir-64) \ + $(wobjdir) $(wobjdir-static) $(wobjdir-32) \ + $(objdir-debug) $(wobjdir-debug) -type f -name '*.a' -print0 | \ + xargs -0r strip-nondeterminism --type ar + # Static debug libraries need _g suffix to avoid file clashes set -e; \ for lib in $(objdir-debug)/lib/*.a; do \ -- 2.1.4 signature.asc Description: Digital signature
Bug#774496: ncurses: please make ncurses build reproducibly
Sven Joachim: I am not strictly opposed to your patch, but I think the problem should be tackled elsewhere, so that fewer packages need to be modified. In our experimental toolchain, packages built using `dh` will automatically call `dh_strip_nondeterminism`. Packages using `dh` are the 60% plateau you can see on: https://jenkins.debian.net/userContent/stats_pkg_state.png Since a few days, we are getting more packages considered reproducible as we moved generation of the .buildinfo files to dpkg-buildpackage instead of doing it as a dh stop. Have you considered filing a wishlist bug against binutils to build with --enable-deterministic-archives, so that ar and ranlib operate in deterministic mode by default? Yes. This is how we did the experiment in January last year: https://wiki.debian.org/ReproducibleBuilds/Rebuild20140126 During discussions at DebConf14, it was acknowledged that having `--enable-deterministic-archives` could break some build systems in subtle ways and that it would be better to do without. Unfortunately, I have never been able to get Matthias Klose's opinion on the matter. Also, what's the current state of #759895? The original patch became part of strip-nondeterminism. I guess it should be updated to ask the inclusion of the following patch: https://anonscm.debian.org/cgit/reproducible/debhelper.git/commit/?h=pu/reproducible_buildsid=7fbd7ba -- Lunar.''`. lu...@debian.org: :Ⓐ : # apt-get install anarchism `. `'` `- signature.asc Description: Digital signature
Bug#774496: ncurses: please make ncurses build reproducibly
On 2015-01-03 14:19 +0100, Jérémy Bobbio wrote: While working on the “reproducible builds” effort [1], we have noticed that ncurses could not be built reproducibly. The attached patch will add calls to strip-nondeterminism on static libraries. Once applied, the package can be built reproducibly with our current experimental framework. I've initially tried to run `ar` in deterministic mode by passing ARFLAGS=Dcrv. Unfortunately, `ranlib` is called after `ar` and there doesn't seem to be a way to pass the `-D` flag to it, and so it will write a timestamp in the newly created index. I am not strictly opposed to your patch, but I think the problem should be tackled elsewhere, so that fewer packages need to be modified. Have you considered filing a wishlist bug against binutils to build with --enable-deterministic-archives, so that ar and ranlib operate in deterministic mode by default? Also, what's the current state of #759895? Cheers, Sven -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#759895: [Reproducible-builds] Bug#774496: ncurses: please make ncurses build reproducibly
On Samstag, 3. Januar 2015, Jérémy Bobbio wrote: Sven Joachim: Also, what's the current state of #759895? The original patch became part of strip-nondeterminism. I guess it should be updated to ask the inclusion of the following patch: https://anonscm.debian.org/cgit/reproducible/debhelper.git/commit/?h=pu/rep roducible_buildsid=7fbd7ba signature.asc Description: This is a digitally signed message part.
