Debian Bug report logs - #1000836
libu2f-host: reproducible builds: Embedded timestamp in u2f-host.pdf

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: submit@bugs.debian.org

Subject: libu2f-host: reproducible builds: Embedded timestamp in u2f-host.pdf

Date: Mon, 29 Nov 2021 15:55:06 -0800

[Message part 1 (text/plain, inline)]

Source: libu2f-host
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

The build timestamp is embedded in u2f-host.pdf:

  https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/libu2f-host.html

  ./usr/share/doc/libu2f-host-dev/u2f-host.pdf

  November·15,·2021
  vs.
  December·20,·2022


The attached patch fixes this by setting FORCE_SOURCE_DATE=1 in
debian/rules, which texlive needs in order to respect SOURCE_DATE_EPOCH,
which is set during debian package builds to the timestamp in the latest
debian/changelog entry.

  https://reproducible-builds.org/docs/source-date-epoch/

With this patch applied, libu2f-host should build reproducibly on
tests.reproducible-builds.org.


Thanks for maintaining libu2f-host!


live well,
  vagrant

[0001-debian-rules-Export-FORCE_SOURCE_DATE-1-in-order-for.patch (text/x-diff, inline)]

From 2c36974647525920b90b147843c63f5dea770cb9 Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Mon, 29 Nov 2021 23:52:14 +0000
Subject: [PATCH] debian/rules: Export FORCE_SOURCE_DATE=1 in order for texlive
 to respect SOURCE_DATE_EPOCH when generating .pdf files.

https://reproducible-builds.org/docs/source-date-epoch/
---
 debian/rules | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/debian/rules b/debian/rules
index 8f2cd0a..8419d06 100755
--- a/debian/rules
+++ b/debian/rules
@@ -2,6 +2,9 @@
 
 export DEB_BUILD_MAINT_OPTIONS = hardening=+all
 
+# Ensure texlive respects SOURCE_DATE_EPOCH
+export FORCE_SOURCE_DATE=1
+
 %:
 	dh $@
 
-- 
2.30.2

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.