[Reproducible-builds] Bug#798557: libapache-dbi-perl: please make the build reproducible

[Dhole]

Source: libapache-dbi-perl
Version: 1.12-1
Severity: wishlist
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-builds@lists.alioth.debian.org

Hi,

While working on the "reproducible builds" effort [1], we have noticed
that libapache-dbi-perl could not be built reproducibly.

The attached patch sets the embedded date in the man pages generated by
podman to the latest debian/changelog entry timestamp instead of local
date. Once applied, libapache-dbi-perl can be built reproducibly in our
current experimental framework.

 [1]: https://wiki.debian.org/ReproducibleBuilds


Regards,
-- 
Dhole
diff -Nru libapache-dbi-perl-1.12/debian/changelog 
libapache-dbi-perl-1.12/debian/changelog
--- libapache-dbi-perl-1.12/debian/changelog2013-06-12 18:17:37.0 
+0200
+++ libapache-dbi-perl-1.12/debian/changelog2015-09-10 00:24:04.0 
+0200
@@ -1,3 +1,11 @@
+libapache-dbi-perl (1.12-1.1) UNRELEASED; urgency=medium
+
+  * Non-maintainer upload.
+  * Replace timestamp in man pages to latest debian/changelog entry timestamp
+to make the package build reproducibly.
+
+ -- Eduard Sanou   Thu, 10 Sep 2015 00:23:31 +0200
+
 libapache-dbi-perl (1.12-1) unstable; urgency=low
 
   [ Salvatore Bonaccorso ]
diff -Nru libapache-dbi-perl-1.12/debian/rules 
libapache-dbi-perl-1.12/debian/rules
--- libapache-dbi-perl-1.12/debian/rules2013-06-12 18:02:44.0 
+0200
+++ libapache-dbi-perl-1.12/debian/rules2015-09-10 00:33:54.0 
+0200
@@ -1,3 +1,7 @@
 #!/usr/bin/make -f
+
+SOURCE_DATE_EPOCH = $(shell date -d "$$(dpkg-parsechangelog -SDate)" +%s)
+export POD_MAN_DATE = $(shell date -u +"%Y-%m-%d" 
--date="@$(SOURCE_DATE_EPOCH)")
+
 %:
dh $@


signature.asc
Description: OpenPGP digital signature
___
Reproducible-builds mailing list
Reproducible-builds@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds

Re: [Reproducible-builds] Bug#798557: libapache-dbi-perl: please make the build reproducible

[Chris Lamb]

On Thu, 10 Sep 2015, at 06:25 PM, Dhole wrote:

> - Make debhelper export POD_MAN_DATE

An abstraction layer violation, surely? Smells really bad to me and sets
a bad precedent for specific-fixes needing to be in a general tool. This
has maintenance issues, as well as being surprising to packagers.

> - Patch podman to honour SOURCE_DATE_EPOCH

Don't see a negative to this. Indeed, it's what this variable was for -
to avoid specific fixes.


Regards,

-- 
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org / chris-lamb.co.uk
   `-

___
Reproducible-builds mailing list
Reproducible-builds@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds

Re: [Reproducible-builds] Bug#798557: libapache-dbi-perl: please make the build reproducible

[Niko Tyni]

On Thu, Sep 10, 2015 at 03:56:03PM +0200, Dhole wrote:

> While working on the "reproducible builds" effort [1], we have noticed
> that libapache-dbi-perl could not be built reproducibly.
> 
> The attached patch sets the embedded date in the man pages generated by
> podman to the latest debian/changelog entry timestamp instead of local
> date. Once applied, libapache-dbi-perl can be built reproducibly in our
> current experimental framework.

> --- libapache-dbi-perl-1.12/debian/rules  2013-06-12 18:02:44.0 
> +0200
> +++ libapache-dbi-perl-1.12/debian/rules  2015-09-10 00:33:54.0 
> +0200
> @@ -1,3 +1,7 @@
>  #!/usr/bin/make -f
> +
> +SOURCE_DATE_EPOCH = $(shell date -d "$$(dpkg-parsechangelog -SDate)" +%s)
> +export POD_MAN_DATE = $(shell date -u +"%Y-%m-%d" 
> --date="@$(SOURCE_DATE_EPOCH)")
> +
>  %:
>   dh $@

This is a toolchain issue that potentially affects hundreds of packages
and should IMO be fixed centrally, at least for those packages that use
these debhelper short form dh rules.

The reason only a handful show up in the current reproducible.debian.net
CI setup is that it only triggers when the two builds happen on different
sides of midnight UTC. Once we start testing builds on different dates,
I expect the number of those to explode.
-- 
Niko Tyni   nt...@debian.org

___
Reproducible-builds mailing list
Reproducible-builds@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds

Re: [Reproducible-builds] Bug#798557: libapache-dbi-perl: please make the build reproducible

[Chris Lamb]

> This is a toolchain issue that potentially affects hundreds of packages
> and should IMO be fixed centrally, at least for those packages that use
> these debhelper short form dh rules.

Really agree with this - we will already have quite a bit of unnecessary
clutter in the archive once we fix a bunch of other toolchain issues, so
minimising this is a good idea.

.. as well as taking time away from fixing the toolchain issue itself ;)


Regards,

-- 
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org / chris-lamb.co.uk
   `-

___
Reproducible-builds mailing list
Reproducible-builds@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds

Re: [Reproducible-builds] Bug#798557: libapache-dbi-perl: please make the build reproducible

[Dhole]

On 09/10/2015 06:10 PM, Niko Tyni wrote:
> This is a toolchain issue that potentially affects hundreds of packages
> and should IMO be fixed centrally, at least for those packages that use
> these debhelper short form dh rules.
> 
After thinking about it, I agree too; a toolchain fix would be more
appropriate for this podman issue.

What do you think would be a better solution?
- Make debhelper export POD_MAN_DATE
- Patch podman to honour SOURCE_DATE_EPOCH (with this option, podman
would replace embedded timestamp either by the env var POD_MAN_DATE, or
by SOURCE_DATE_EPOCH. The later would need formatting the timestamp to
"%Y-%m-%d")

> The reason only a handful show up in the current reproducible.debian.net
> CI setup is that it only triggers when the two builds happen on different
> sides of midnight UTC. Once we start testing builds on different dates,
> I expect the number of those to explode.
> 
The difference that shows up in the affected packages in
reproducible.debian.net show a difference in the day within the
timestamp, because we use two different timezones between builds that
have a 26h difference. That makes the embedded timestamp to have a
different day whenever the package is built. I don't understand why when
we start testing builds on different dates you expect this to explode.
Am I missing anything? Maybe you are referring to timestamps in general,
and not only to this podman embedding timestamps issue? (in which case,
I'd agree that the number of issues like this will explode)

Regards,
-- 
Dhole



signature.asc
Description: OpenPGP digital signature
___
Reproducible-builds mailing list
Reproducible-builds@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds