[Pkg-javascript-devel] Bug#834988: twitter-bootstrap3: please make the build reproducible

[Antonio Terceiro]

On Tue, Oct 25, 2016 at 12:33:23PM +0100, Chris Lamb wrote:
> Hi Antonio,
> 
> Thanks for the explanation. Looking at the patch quickly:
> 
>   year := $(shell date -d @$(SOURCE_DATE_EPOCH) +%Y)
> 
> This should actually be:
> 
>   year := $(shell date -u -d @$(SOURCE_DATE_EPOCH) +%Y)
> 
> … otherwise it will not be reproducible "on" New Years Eve or New Year's Day
> due to timezones. :)

right. I pushed an update, but won't upload just for that. thanks


signature.asc
Description: PGP signature
-- 
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#834988: twitter-bootstrap3: please make the build reproducible

[Chris Lamb]

Hi Antonio,

Thanks for the explanation. Looking at the patch quickly:

  year := $(shell date -d @$(SOURCE_DATE_EPOCH) +%Y)

This should actually be:

  year := $(shell date -u -d @$(SOURCE_DATE_EPOCH) +%Y)

… otherwise it will not be reproducible "on" New Years Eve or New Year's Day
due to timezones. :)


Regards,

-- 
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org / chris-lamb.co.uk
   `-

-- 
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#834988: twitter-bootstrap3: please make the build reproducible

[Antonio Terceiro]

On Mon, Oct 24, 2016 at 10:52:58PM +0100, Chris Lamb wrote:
> Antonio Terceiro wrote:
> 
> > Unfortunately this patch does not fix the issue as the file it changes
> > is not actually used in the Debian build.
> 
> Interesting. Could you elaborate?

At some point in the past the upstream build for a number of existing
packages (jquery and bootstrap come to mind) switched to using grunt,
which is not packaged in Debian and has a gazillion dependencies.

Both on jquery and on twitter-bootstrap3, the grunt build has to be
emulated by other means, and in twitter-bootstrap3, the code that
actually generates that unreproducible copyright message in is
debian/rules:

https://anonscm.debian.org/cgit/pkg-javascript/twitter-bootstrap.git/commit/?id=7ebbdfe1e51ec5460b66c30ace8b913c8c48332f

> I would have tested it at the time, I would hope!

You might have tested with the upstream build using grunt, which can't
be used in Debian at the moment.


signature.asc
Description: PGP signature
-- 
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#834988: twitter-bootstrap3: please make the build reproducible

[Chris Lamb]

Antonio Terceiro wrote:

> Unfortunately this patch does not fix the issue as the file it changes
> is not actually used in the Debian build.

Interesting. Could you elaborate? I would have tested it at the time, I
would hope!


Regards,

-- 
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org / chris-lamb.co.uk
   `-

-- 
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#834988: twitter-bootstrap3: please make the build reproducible

[Antonio Terceiro]

On Mon, Oct 24, 2016 at 06:42:07AM +0100, Chris Lamb wrote:
> Dear Maintainer,
> 
> > Source: twitter-bootstrap3
> > Version: 3.3.6+dfsg-1
> > Tags: patch
> 
> There hasn't seem to be any update on this bug in 63 days, in which
> time the Reproducible Builds effort has come on a long way. :)
> 
> Would you consider applying this patch and uploading?

Unfortunately this patch does not fix the issue as the file it changes
is not actually used in the Debian build.


signature.asc
Description: PGP signature
-- 
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#834988: twitter-bootstrap3: please make the build reproducible

[Chris Lamb]

Dear Maintainer,

> Source: twitter-bootstrap3
> Version: 3.3.6+dfsg-1
> Tags: patch

There hasn't seem to be any update on this bug in 63 days, in which
time the Reproducible Builds effort has come on a long way. :)

Would you consider applying this patch and uploading?


Regards,

-- 
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org / chris-lamb.co.uk
   `-

-- 
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#834988: twitter-bootstrap3: please make the build reproducible

[Chris Lamb]

Source: twitter-bootstrap3
Version: 3.3.6+dfsg-1
Severity: wishlist
Tags: patch
User: reproducible-bui...@lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-bui...@lists.alioth.debian.org

Hi,

Whilst working on the Reproducible Builds effort [0], I noticed
that twitter-bootstrap3 could not be built reproducibly.

Patch attached.

 [0] https://reproducible-builds.org/


Regards,

-- 
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org / chris-lamb.co.uk
   `-
--- a/debian/patches/reproducible-build.patch   1970-01-01 01:00:00.0 
+0100
--- b/debian/patches/reproducible-build.patch   2016-08-21 11:54:36.103131504 
+0100
@@ -0,0 +1,15 @@
+Description: Make the build reproducible
+Author: Chris Lamb 
+Last-Update: 2016-08-21
+
+--- twitter-bootstrap3-3.3.6+dfsg.orig/docs/assets/js/src/customizer.js
 twitter-bootstrap3-3.3.6+dfsg/docs/assets/js/src/customizer.js
+@@ -14,7 +14,7 @@ window.onload = function () { // wait fo
+ 
+   var cw = '/*!\n' +
+' * Bootstrap v3.3.5 (http://getbootstrap.com)\n' +
+-   ' * Copyright 2011-' + new Date().getFullYear() + ' Twitter, 
Inc.\n' +
++   ' * Copyright 2011-' + (new Date(process.env.SOURCE_DATE_EPOCH ? 
(process.env.SOURCE_DATE_EPOCH * 1000) : new Date().getTime())).getFullYear() + 
' Twitter, Inc.\n' +
+' * Licensed under MIT 
(https://github.com/twbs/bootstrap/blob/master/LICENSE)\n' +
+' */\n\n'
+ 
--- a/debian/patches/series 1970-01-01 01:00:00.0 +0100
--- b/debian/patches/series 2016-08-21 11:54:46.991242483 +0100
@@ -0,0 +1 @@
+reproducible-build.patch
-- 
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel