Debian Bug report logs - #1024396
brewtarget: reproducible builds: Embeds kernel version in /usr/bin/brewtarget

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: submit@bugs.debian.org

Subject: brewtarget: reproducible builds: Embeds build date in /usr/bin/brewtarget

Date: Fri, 18 Nov 2022 10:44:29 -0800

[Message part 1 (text/plain, inline)]

Source: brewtarget
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: kernel
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

The build date is embedded in /usr/bin/brewtarget:

  https://tests.reproducible-builds.org/debian/rb-pkg/bookworm/amd64/diffoscope-results/brewtarget.html

  Linux-5.10.0-19-amd64
  vs.
  Linux-5.19.0-0.deb11.2-amd64

The attached patch to src/main.cpp fixes this by removing
CMAKE_HOST_SYSTEM and CMAKE_SYSTEM, which includes the kernel version.

According to my local tests, With this patch applied brewtarget should
build reproducibly on tests.reproducible-builds.org!

Thanks for maintaining brewtarget!

live well,
  vagrant

[0001-src-main.cpp-do-not-embed-the-value-of-CMAKE_HOST_SY.patch (text/x-diff, inline)]

From b3b4f7b8bc2b3f08f32a1d3ead764468c0bdf23a Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Fri, 18 Nov 2022 18:35:14 +0000
Subject: [PATCH] src/main.cpp: do not embed the value of CMAKE_HOST_SYSTEM or
 CMAKE_SYSTEM.

This embeds the version of the running kernel, breaking reproducible
builds.

https://tests.reproducible-builds.org/debian/issues/unstable/captures_kernel_version_via_CMAKE_SYSTEM_issue.html
---
 src/main.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main.cpp b/src/main.cpp
index 227d530..2cc767f 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -195,7 +195,7 @@ int main(int argc, char **argv) {
          "Starting" << CONFIG_APPLICATION_NAME_UC << "v" << CONFIG_VERSION_STRING << " (app name" <<
          app.applicationName() << ") on " << QSysInfo::prettyProductName();
       qInfo() <<
-         "Built at" << BUILD_TIMESTAMP << "on" << CMAKE_HOST_SYSTEM << "for" << CMAKE_SYSTEM << "with" <<
+         "Built at" << BUILD_TIMESTAMP <<
          CMAKE_CXX_COMPILER_ID << "compiler";
       qInfo() << "Log directory:" << Logging::getDirectory().absolutePath();
       qInfo() << "Using Qt runtime v" << qVersion() << " (compiled against Qt v" << QT_VERSION_STR << ")";
-- 
2.30.2

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 1024396@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: 1024396@bugs.debian.org

Subject: Re: brewtarget: reproducible builds: Embeds kernel version in /usr/bin/brewtarget

Date: Fri, 18 Nov 2022 12:04:18 -0800

[Message part 1 (text/plain, inline)]

Control: retitle 1024396 brewtarget: reproducible builds: Embeds kernel version in /usr/bin/brewtarget

On 2022-11-18, Vagrant Cascadian wrote:
> The build date is embedded in /usr/bin/brewtarget:

I *meant* to say kernel version! Sorry for the confusion

>   https://tests.reproducible-builds.org/debian/rb-pkg/bookworm/amd64/diffoscope-results/brewtarget.html
>
>   Linux-5.10.0-19-amd64
>   vs.
>   Linux-5.19.0-0.deb11.2-amd64

live well,
  vagrant

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 1024396@bugs.debian.org (full text, mbox, reply):

From: Paul Wise <pabs@debian.org>

To: 1024396@bugs.debian.org, Vagrant Cascadian <vagrant@reproducible-builds.org>

Subject: Re: brewtarget: reproducible builds: Embeds build date in /usr/bin/brewtarget

Date: Sat, 19 Nov 2022 21:09:46 +0800

[Message part 1 (text/plain, inline)]

On Fri, 18 Nov 2022 10:44:29 -0800 Vagrant Cascadian wrote:

> -         "Built at" << BUILD_TIMESTAMP << "on" << CMAKE_HOST_SYSTEM << "for" << CMAKE_SYSTEM << "with" <<
> +         "Built at" << BUILD_TIMESTAMP <<

Wouldn't it be better to just remove this line entirely, since with
reproducible builds, the "build timestamp" will always be the same,
so isn't really a build timestamp but a source code change timestamp?

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[signature.asc (application/pgp-signature, inline)]

Message #22 received at 1024396@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: Paul Wise <pabs@debian.org>, 1024396@bugs.debian.org

Subject: Re: brewtarget: reproducible builds: Embeds kernel version in /usr/bin/brewtarget

Date: Sat, 19 Nov 2022 16:53:26 -0800

[Message part 1 (text/plain, inline)]

On 2022-11-19, Paul Wise wrote:
> On Fri, 18 Nov 2022 10:44:29 -0800 Vagrant Cascadian wrote:
>
>> -         "Built at" << BUILD_TIMESTAMP << "on" << CMAKE_HOST_SYSTEM << "for" << CMAKE_SYSTEM << "with" <<
>> +         "Built at" << BUILD_TIMESTAMP <<
>
> Wouldn't it be better to just remove this line entirely, since with
> reproducible builds, the "build timestamp" will always be the same,
> so isn't really a build timestamp but a source code change timestamp?

That is a reasonable argument! There are no timestamps quite like no
timestamps... definitely preferred for reproducible builds to remove the
timestamps entirely if possible!

For a debian package, the version of the installed package is usually
known, so the packaging changelog, https://buildd.debian.org, .buildinfo
file, etc. can be used to get various relevent timestamps.

That said, I do not know exactly how this is used in the code, so making
it empty or non-existent would require further verification, and at
least it seems to respect SOURCE_DATE_EPOCH for the moment for a
deterministic timestamp.


live well,
  vagrant

[signature.asc (application/pgp-signature, inline)]

Message #27 received at 1024396-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 1024396-close@bugs.debian.org

Subject: Bug#1024396: fixed in brewtarget 3.0.6-1

Date: Tue, 28 Feb 2023 13:04:11 +0000

Source: brewtarget
Source-Version: 3.0.6-1
Done: Dr. Tobias Quathamer <toddy@debian.org>

We believe that the bug you reported is fixed in the latest version of
brewtarget, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1024396@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Dr. Tobias Quathamer <toddy@debian.org> (supplier of updated brewtarget package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Tue, 28 Feb 2023 13:40:54 +0100
Source: brewtarget
Architecture: source
Version: 3.0.6-1
Distribution: unstable
Urgency: medium
Maintainer: Dr. Tobias Quathamer <toddy@debian.org>
Changed-By: Dr. Tobias Quathamer <toddy@debian.org>
Closes: 1024396
Changes:
 brewtarget (3.0.6-1) unstable; urgency=medium
 .
   * New upstream version 3.0.6
 .
   [ Debian Janitor ]
   * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository-Browse.
     Changes-By: lintian-brush
     Fixes: lintian: upstream-metadata-file-is-missing
     Fixes: lintian: upstream-metadata-missing-bug-tracking
   * Fix day-of-week for changelog entry 2.0.1-1.
     Changes-By: lintian-brush
     Fixes: lintian: debian-changelog-has-wrong-day-of-week
   * Set upstream metadata fields: Repository.
     Changes-By: lintian-brush
     Fixes: lintian: upstream-metadata-missing-repository
 .
   [ Dr. Tobias Quathamer ]
   * Fix lintian warning about not closing bugs
   * Make the build reproducible.
     Thanks to Vagrant Cascadian <vagrant@reproducible-builds.org>
     (Closes: #1024396)
   * Disable Link Time Optimization (LTO). (LP: #2004076)
Checksums-Sha1:
 5826fbe317a49b405ecca1f052ba5b90c01431fc 2016 brewtarget_3.0.6-1.dsc
 eb4fe4bbce51948a393d58e483786d421574e61f 13428537 brewtarget_3.0.6.orig.tar.gz
 ebdcbd4719c958b50c22728f602a3f3db5fa20cc 11108 brewtarget_3.0.6-1.debian.tar.xz
 89d88a161c53953bf09d82d6da8cd9babcb04789 13083 brewtarget_3.0.6-1_amd64.buildinfo
Checksums-Sha256:
 e9bb483869eb652c04fa49f735bb989e1708dd88f216a7613c8c20fcea31052d 2016 brewtarget_3.0.6-1.dsc
 72abf79327fc21effc8fafcaa0c18e96ccb37a0d3bae13b42a2be457fb424fc4 13428537 brewtarget_3.0.6.orig.tar.gz
 1db5abfb47b26a71e4e949b6d5a66c9ed2556838986006be20b73617164dc299 11108 brewtarget_3.0.6-1.debian.tar.xz
 f31667ff65aa8036d0cd4fbf06ef31bc373b5d6d1585b8a7b1b746f8a053065d 13083 brewtarget_3.0.6-1_amd64.buildinfo
Files:
 0dd3d7f48d4f2f1b97b9f834f948cbe0 2016 misc optional brewtarget_3.0.6-1.dsc
 f852b57a0ac357b4ff3c1d706b8f7c2f 13428537 misc optional brewtarget_3.0.6.orig.tar.gz
 41c37c6a31b6dc712af1070a8c7e73a7 11108 misc optional brewtarget_3.0.6-1.debian.tar.xz
 b983b26140cd172dfc866a00129babc0 13083 misc optional brewtarget_3.0.6-1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE0cuPObxd7STF0seMEwLx8Dbr6xkFAmP99/0ACgkQEwLx8Dbr
6xmJCw/+NLWTAkT0F9pym21qYYPl8V1a1RtSwVtZ6KPgtqoolL3fgS+5eTsyWIkQ
Vdq+3iB5gvvDb0mGXLD1HzM7mcNvCkn/idvMdRvZ/jC6gPhbCmCv7ibjepGUVnLX
faMK00qnbG8ni7kNnOnf2sWNtCFIw7wEAfQVYqbl2VoYKqNxbyDcETz3Xt+k87kq
iUXH9q/sNaeqL05HTliGXagCbB0+HT8qqFAuMW625fU7N5E0LAjofEaq+2dmgqT/
cIH8H7ck0sD1A4SjPq/KCdrQUeTs1oDNbKCdSa6yFpGy/tDb6Su0nIbJLoGH7qcc
R+bH4eN2W2mS6dVd1oQKf9Y8G9UD07coB9IeC4/Bx6FuoVABiaNP6aoLVsleFbrx
u1t/PjTVI+FGEIgPThzOIYnnxQRUptuWC2IXxE3uyynZwRKOTDd9knY3oinnjj8V
hsTKnlg5oITvq2iNJ+x35qh8r9s5WlR/ZzkNQqBqWQ4HAxbzndeUfW5iPhqaNQF5
30UxEhZqckqZxDpXM213QkWdaQVmVRh/ZovjdgNBo5t7vPHfQTrhlt/3w/xLp4BH
lnZ4PglFhbfTdwBb9y7MqSZKbB5Qul039sgACn7dCCjE8huUhnkr0SG7tX+frgNB
H1/zOWZ7838ePxAcI4oJrsoWtMk9X0xWKIP3dJggdmA06T91JDg=
=bBgI
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.