Debian Bug report logs - #1021513
centrifuge: reproducible builds: Embeds build time and hostname in centrifuge-build-bin

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: submit@bugs.debian.org

Subject: centrifuge: reproducible builds: Embeds build time and hostname in centrifuge-build-bin

Date: Sun, 09 Oct 2022 15:30:45 -0700

[Message part 1 (text/plain, inline)]

Source: centrifuge
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: hostname timestamps
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

The time and hostname are embedded in /usr/lib/centrifuge/centrifuge-build-bin:

  https://tests.reproducible-builds.org/debian/rb-pkg/bookworm/amd64/diffoscope-results/centrifuge.html

  ionos5-amd64
  vs.
  i-capture-the-hostname
  
  Fri·Nov·10·04:07:04·-12·2023
  vs.
  Sat·Oct··8·23:46:23·+14·2022

The attached patch to the upstream Makefile fixes this by setting a
place holder value for BUILD_HOST and uses SOURCE_DATE_EPOCH for
BUILD_TIME.

According to my local tests, with this patch applied, centrifuge should
build reproducibly on tests.reproducible-builds.org!

Thanks for maintaining centrifuge!

live well,
  vagrant
 

[0001-Makefile-Use-consistent-build-time-and-build-host.patch (text/x-diff, inline)]

From 02388806caa80233efa22e874ee1748da3f51109 Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Sun, 9 Oct 2022 22:22:14 +0000
Subject: [PATCH] Makefile: Use consistent build time and build host.

https://reproducible-builds.org/docs/source-date-epoch/
---
 Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 66775a8..e24685e 100644
--- a/Makefile
+++ b/Makefile
@@ -248,8 +248,8 @@ both-debug: centrifuge-class-debug centrifuge-build-bin-debug
 
 DEFS=-fno-strict-aliasing \
      -DCENTRIFUGE_VERSION="\"$(GIT_VERSION)\"" \
-     -DBUILD_HOST="\"`hostname`\"" \
-     -DBUILD_TIME="\"`date`\"" \
+     -DBUILD_HOST="\"BUILDHOST\"" \
+     -DBUILD_TIME="\"`date --utc --date=@$(SOURCE_DATE_EPOCH) +%F`\"" \
      -DCOMPILER_VERSION="\"`$(CXX) -v 2>&1 | tail -1`\"" \
      $(FILE_FLAGS) \
 	 $(CFLAGS) \
-- 
2.37.2

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 1021513-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 1021513-close@bugs.debian.org

Subject: Bug#1021513: fixed in centrifuge 1.0.3-11

Date: Mon, 10 Oct 2022 06:19:00 +0000

Source: centrifuge
Source-Version: 1.0.3-11
Done: Andreas Tille <tille@debian.org>

We believe that the bug you reported is fixed in the latest version of
centrifuge, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1021513@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andreas Tille <tille@debian.org> (supplier of updated centrifuge package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 10 Oct 2022 07:52:41 +0200
Source: centrifuge
Architecture: source
Version: 1.0.3-11
Distribution: unstable
Urgency: medium
Maintainer: Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>
Changed-By: Andreas Tille <tille@debian.org>
Closes: 1021513
Changes:
 centrifuge (1.0.3-11) unstable; urgency=medium
 .
   * Builds reproducibly (thanks for the patch to Vagrant Cascadian)
     Closes: #1021513
   * Standards-Version: 4.6.1 (routine-update)
   * Set upstream metadata fields: Repository-Browse.
   * Lintian-overrides for false positive (see lintian bug #1017966)
Checksums-Sha1:
 2e6fa5292b1596e1c4920544535b688cfd8796d0 2037 centrifuge_1.0.3-11.dsc
 8be8e53beb61d1f6a4b681b1e383999e99bde55d 15220 centrifuge_1.0.3-11.debian.tar.xz
 a69c327b713c5bae43e623d5c236cc3a0ff4210f 7414 centrifuge_1.0.3-11_amd64.buildinfo
Checksums-Sha256:
 e0eefac5931e881ea4ef68b82653cfe870c48cb14ed0e02622dc2a4dc5e75149 2037 centrifuge_1.0.3-11.dsc
 bdf867738f93e51112837a45b213b0fb3be9950bda5062f9cd179f9f348d5429 15220 centrifuge_1.0.3-11.debian.tar.xz
 531e1d71eed805b11e8c70208064b7de6cee4e21c3badf226ff094e8550ce001 7414 centrifuge_1.0.3-11_amd64.buildinfo
Files:
 614b463d7b4108d838f1b1e8867e278e 2037 science optional centrifuge_1.0.3-11.dsc
 2e0e361b6c2198258d63e58f6cc8758e 15220 science optional centrifuge_1.0.3-11.debian.tar.xz
 d442e35f4cdc14af6567fdd540f6518d 7414 science optional centrifuge_1.0.3-11_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEE8fAHMgoDVUHwpmPKV4oElNHGRtEFAmNDtB0RHHRpbGxlQGRl
Ymlhbi5vcmcACgkQV4oElNHGRtEu9w/+JENzIU0ET6mD14d017aOV/r+7tLEnwr4
rdn2thghJ4r1ooVR/ZaddPU8peOvFvSg2y6BsmtCYoAAg+YhE0P/oebkkuWY4one
v5oSJmODwqIxHZhfSzfO3ugK3qA8n9r4glTPbrfu5iXy09ukkWYv9UUMO+QLwh69
eilZgwHtRcJxi5G9ksfm05JyxG1qsUGjIC2Yq5TN8AQQeHEK4HCPb1URCNXzMpSk
T7QVTLr2wcb+tsfMKh8xESCpBvsKjHAyet/kV5SLZcKYW6JhUIuA90oCWtDV8Sls
AdE6rKkAlE+d9EWjr577bOBtJg5psOGfj64LKK5Xhbytfljj2bd6/m8ydIZ4epRO
fBkbRDv6Nt2YTVibuKaoCIq+p0W2JgxuEtaACm21oGrAgKOg8o5hJubLxJSzQThM
mkb6lnSI7amSG1HZ9q0pIYTLYi3HHugZV6hS7fo2Wi6aent+CxVPP7cEZoE2S67t
N4Z6cOUk+1js+wPzZwmgwEp04zgmZ/AauSm2uIvxZN8i/oA7Tb4SjpV+C5kwQD37
OzqTIGG/Qshs7QUBxJ4Naama2fY5ZhyMZp9CGy5ONMlb5FmyHoCzn1HtgT9Y5xWv
BgCpTaQlufpvtvosN9cVX6mBzvYQq77GZ1Xp6RCBBT6MBJdR+/YSsX8cKfos8sDj
iIdlNDnCuz4=
=FoNQ
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.