Bug#877470: bsh; please make the build reproducible (timestamps)

[jathan]

On Wed, 04 Oct 2017 07:27:08 +0100 Chris Lamb  wrote:
> Hi,
> 
> > bsh; please make the build reproducible (timestamps)
> 
> +SOURCE_DATE_EPOCH   ?= $(shell dpkg-parsechangelog -STimestamp)
> 
> I'd actually use /usr/share/dpkg/pkg-info.mk for this :)
> 
> +   --clamp-mtime --mtime="$(SOURCE_DATE_EPOCH)"
> 
> Shouldn't this be --mtime="@$(SOURCE_DATE_EPOCH)" (nb. with the @?)
> 
> 
> Regards,
> 
> -- 
>   ,''`.
>  : :'  : Chris Lamb
>  `. `'`  la...@debian.org / chris-lamb.co.uk
>`-
> 
> Hi,

I have rewrited the bsh patch based on the observations and suggestions
of Lamby, sending a new bsh_2.0b4-18_2.0b4-18.1.debdiff file. The
attached patch clamps the timestamps to the changelog timestamp when
creating the source archive using SOURCE_DATE_EPOCH variable. Once
applied, bsh can be built reproducibly in our current experimental
framework. Cheers.

Jathan

-- 
Por favor evita enviarme adjuntos en formato de word o powerpoint, si
quieres saber porque lee esto:
http://www.gnu.org/philosophy/no-word-attachments.es.html
¡Cámbiate a GNU/Linux! http://getgnulinux.org/es
diff -Nru bsh-2.0b4/debian/changelog bsh-2.0b4/debian/changelog
--- bsh-2.0b4/debian/changelog  2016-05-30 12:14:02.0 -0500
+++ bsh-2.0b4/debian/changelog  2017-10-24 23:46:23.0 -0500
@@ -1,3 +1,10 @@
+bsh (2.0b4-18.1) UNRELEASED; urgency=medium
+
+  * Non-maintainer upload.
+  * Fix timestamps_in_tarball reproducible build issue. 
+
+ -- Jonathan Bustillos   Tue, 24 Oct 2017 
23:46:23 -0500
+
 bsh (2.0b4-18) unstable; urgency=medium
 
   * Team upload.
diff -Nru bsh-2.0b4/debian/rules bsh-2.0b4/debian/rules
--- bsh-2.0b4/debian/rules  2016-05-30 12:06:22.0 -0500
+++ bsh-2.0b4/debian/rules  2017-10-24 23:44:07.0 -0500
@@ -1,6 +1,7 @@
 #!/usr/bin/make -f
 # debian/rules file for bsh (uses cdbs)
 
+include /usr/share/dpkg/pkg-info.mk
 include /usr/share/cdbs/1/rules/debhelper.mk
 include /usr/share/cdbs/1/class/ant.mk
 
@@ -29,6 +30,7 @@
 install/bsh-src:: binary-install/bsh-doc
mkdir -p debian/bsh-src/usr/src/bsh-src
tar --exclude debian --exclude classes --exclude dist --exclude api \
+   --clamp-mtime --mtime="@$(SOURCE_DATE_EPOCH)" \ 
-zcf debian/bsh-src/usr/src/bsh-src/bsh.tar.gz *
 
 binary-fixup/bsh-doc::


signature.asc
Description: OpenPGP digital signature
__
This is the maintainer address of Debian's Java team
. 
Please use
debian-j...@lists.debian.org for discussions and questions.

Bug#877470: bsh; please make the build reproducible (timestamps)

[jathan]

On Mon, 2 Oct 2017 17:11:48 +0200 Emmanuel Bourg  wrote:
> Thank you for the patch Jathan.
> 
> Aren't tar timestamps already normalized by strip-nondeterminism though?
> 
> Emmanuel Bourg
> 
> 
Hi Emmanuel,

Tar timestamps are not normalized by strip-nondeterminism. Best regards.

Jathan

-- 
Por favor evita enviarme adjuntos en formato de word o powerpoint, si
quieres saber porque lee esto:
http://www.gnu.org/philosophy/no-word-attachments.es.html
¡Cámbiate a GNU/Linux! http://getgnulinux.org/es



signature.asc
Description: OpenPGP digital signature
__
This is the maintainer address of Debian's Java team
. 
Please use
debian-j...@lists.debian.org for discussions and questions.

Bug#877470: bsh; please make the build reproducible (timestamps)

[Chris Lamb]

Hi,

> bsh; please make the build reproducible (timestamps)

+SOURCE_DATE_EPOCH   ?= $(shell dpkg-parsechangelog -STimestamp)

I'd actually use /usr/share/dpkg/pkg-info.mk for this :)

+ --clamp-mtime --mtime="$(SOURCE_DATE_EPOCH)"

Shouldn't this be --mtime="@$(SOURCE_DATE_EPOCH)" (nb. with the @?)


Regards,

-- 
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org / chris-lamb.co.uk
   `-

__
This is the maintainer address of Debian's Java team
. 
Please use
debian-j...@lists.debian.org for discussions and questions.

Bug#877470: bsh; please make the build reproducible (timestamps)

[Emmanuel Bourg]

Thank you for the patch Jathan.

Aren't tar timestamps already normalized by strip-nondeterminism though?

Emmanuel Bourg

__
This is the maintainer address of Debian's Java team
. 
Please use
debian-j...@lists.debian.org for discussions and questions.

Bug#877470: bsh; please make the build reproducible (timestamps)

[jathan]

Source: bsh
Version: 2.0b4-18
Severity: wishlist
Tags: patch
User: reproducible-bui...@lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-b...@lists.alioth.debian.org

Hi!

While working on the “reproducible builds” effort [1], we have noticed
that bsh could not be built reproducibly.

The attached patch clamps the timestamps to the changelog timestamp when
creating the source archive. Once applied, bsh can be built reproducibly
in our current experimental framework. Best regards.

Jathan

 [1]: https://wiki.debian.org/ReproducibleBuilds

-- 
Por favor evita enviarme adjuntos en formato de word o powerpoint, si
quieres saber porque lee esto:
http://www.gnu.org/philosophy/no-word-attachments.es.html
¡Cámbiate a GNU/Linux! http://getgnulinux.org/es
diff -Nru bsh-2.0b4/debian/changelog bsh-2.0b4/debian/changelog
--- bsh-2.0b4/debian/changelog  2016-05-30 12:14:02.0 -0500
+++ bsh-2.0b4/debian/changelog  2017-10-01 22:01:37.0 -0500
@@ -1,3 +1,10 @@
+bsh (2.0b4-18.1) UNRELEASED; urgency=medium
+
+  * Non-maintainer upload.
+  * Fix timestamps_in_tarball reproducible build issue.
+
+ -- Jonathan Bustillos   Sun, 01 Oct 2017 
22:01:37 -0500
+
 bsh (2.0b4-18) unstable; urgency=medium
 
   * Team upload.
diff -Nru bsh-2.0b4/debian/rules bsh-2.0b4/debian/rules
--- bsh-2.0b4/debian/rules  2016-05-30 12:06:22.0 -0500
+++ bsh-2.0b4/debian/rules  2017-10-01 22:00:30.0 -0500
@@ -1,6 +1,7 @@
 #!/usr/bin/make -f
 # debian/rules file for bsh (uses cdbs)
 
+SOURCE_DATE_EPOCH   ?= $(shell dpkg-parsechangelog -STimestamp)
 include /usr/share/cdbs/1/rules/debhelper.mk
 include /usr/share/cdbs/1/class/ant.mk
 
@@ -29,6 +30,7 @@
 install/bsh-src:: binary-install/bsh-doc
mkdir -p debian/bsh-src/usr/src/bsh-src
tar --exclude debian --exclude classes --exclude dist --exclude api \
+ --clamp-mtime --mtime="$(SOURCE_DATE_EPOCH)" \
-zcf debian/bsh-src/usr/src/bsh-src/bsh.tar.gz *
 
 binary-fixup/bsh-doc::


signature.asc
Description: OpenPGP digital signature
__
This is the maintainer address of Debian's Java team
. 
Please use
debian-j...@lists.debian.org for discussions and questions.