Debian Bug report logs - #1017073
python-suntime: reproducible builds: Timestamps recorded for all packaged files

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: submit@bugs.debian.org

Subject: python-suntime: reproducible builds: Timestamps recorded for all packaged files

Date: Fri, 12 Aug 2022 19:43:51 -0700

[Message part 1 (text/plain, inline)]

Source: python-suntime
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: timestamps locales
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

All the timestamps in python-suntime vary based on the build time:

  https://tests.reproducible-builds.org/debian/rb-pkg/bookworm/amd64/diffoscope-results/python-suntime.html

  1 	-rw-r--r--···0········0········0········4·2023-08-24·15:33:27.000000·debian-binary	1 	-rw-r--r--···0········0········0········4·2022-07-22·09:11:52.000000·debian-binary
  2 	-rw-r--r--···0········0········0·····1212·2023-08-24·15:33:27.000000·control.tar.xz	2 	-rw-r--r--···0········0········0·····1212·2022-07-22·09:11:52.000000·control.tar.xz
  3 	-rw-r--r--···0········0········0·····4196·2023-08-24·15:33:27.000000·data.tar.xz	3 	-rw-r--r--···0········0········0·····4200·2022-07-22·09:11:52.000000·data.tar.xz

This *should* be handled by dpkg, but for some reason it does not. At
first, I thought it might be the incorrectly formatted line in
debian/changelog:

-  Sandro Tosi <morph@debian.org>  Mon, 20 Jun 2022 23:02:36 -0400
+ -- Sandro Tosi <morph@debian.org>  Mon, 20 Jun 2022 23:02:36 -0400

But that doesn't seem to be the case; SOURCE_DATE_EPOCH is set at all
stages during the build, and fixing this doesn't change the results.

I'm not sure why... but forcing a consistant locale appears to
fix/workaround the issue. Patch attached which sets LC_ALL and LANG to
C.UTF-8 in debian/rules, does not trigger the issue.


With this patch applied, python-suntime should build reproducibly on
tests.reproducible-builds.org!


Thanks for maintaining python-suntime!


live well,
  vagrant

[0001-debian-rules-Set-LC_ALL-and-LANG-to-ensure-reproduci.patch (text/x-diff, inline)]

From 4adc1ba9ea7c004d819029c8273287091c50978f Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Sat, 13 Aug 2022 02:33:12 +0000
Subject: [PATCH] debian/rules: Set LC_ALL and LANG to ensure reproducible
 build.

The timestamps of all files seem to vary otherwise.
---
 debian/rules | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/debian/rules b/debian/rules
index fd7232c..b123c57 100755
--- a/debian/rules
+++ b/debian/rules
@@ -1,6 +1,8 @@
 #!/usr/bin/make -f
 
 export PYBUILD_NAME=suntime
+export LC_ALL=C.UTF-8
+export LANG=C.UTF-8
 
 %:
 	dh $@ --with python3 --buildsystem=pybuild
-- 
2.36.1

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 1017073@bugs.debian.org (full text, mbox, reply):

From: James Addison <jay@jp-hosting.net>

To: Debian Bug Tracking System <1017073@bugs.debian.org>

Subject: Re: python-suntime: reproducible builds: Timestamps recorded for all packaged files

Date: Fri, 09 Sep 2022 20:01:05 +0100

Source: python-suntime
Followup-For: Bug #1017073
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

Hi vagrant,

From some local builds here, you may have been onto something when you noticed
the formatting inconsistency in the debian/changelog file.

When I try building python-suntime from source locally, the locale exports in
the patch *don't* seem to fix the problem; the mtimes of the debian-binary and
control.tar.xz files in the output deb file continue to vary during each build.

But: after correcting the most recent changelog line, the file mtimes become
stable.

Note: in addition to the formatting issue, the timestamps in the changelog file
are out-of-order -- the most recent changelog has a timestamp that is older
than the second-most-recent entry.

This may have happened during commit below, which was likely intended to update
the most-recent entry -- but did not, perhaps due to the formatting problem:

https://salsa.debian.org/python-team/packages/python-suntime/-/commit/af7c127cf54ba10d530024319979ccb4e268c5d0

Thanks,
James

Message #15 received at 1017073@bugs.debian.org (full text, mbox, reply):

From: James Addison <jay@jp-hosting.net>

To: Debian Bug Tracking System <1017073@bugs.debian.org>

Subject: Re: python-suntime: reproducible builds: Timestamps recorded for all packaged files

Date: Wed, 28 Sep 2022 16:11:55 +0100

Source: python-suntime
Followup-For: Bug #1017073
X-Debbugs-Cc: jay@jp-hosting.net
Control: close -1 1.2.5-5

The package's changelog format is valid again in salsa following a refresh[1] that re-combined a divergent development history.  Release 1.2.5-5 looks good in terms of build reproducibility.

[1] - https://salsa.debian.org/python-team/packages/python-suntime/-/commit/683a9656a89bdcade60fa6c8b839026fdf23f1e1

Message #26 received at 1017073@bugs.debian.org (full text, mbox, reply):

From: "LIAM B. OMARI" <pegxukosuz@outlook.com>

Subject: For your kind attention!

Date: Mon, 17 Oct 2022 12:26:19 +0000

[Message part 1 (text/plain, inline)]

Your reputable profile gives me the impression that you will be a suitable partner in a crude oil licensing operations venture involving the National Oil Company of Equatorial Guinea (GEPetrol) and the company I work for which is Sinopec Group. This venture will see us netting in $14m in Revenue approximately per transaction.


On your response I will give you clearer details of this operation. I can be reached directly with the following email account;  boey.mangue@gmail.com


Regards,

Mangue Boey.

[Message part 2 (text/html, inline)]

Send a report that this bug log contains spam.