Debian Bug report logs - #1036571
vcmi: reproducible-builds: build timestamps in binaries

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: submit@bugs.debian.org

Subject: vcmi: reproducible-builds: build timestamps in binaries

Date: Mon, 22 May 2023 15:14:28 -0700

[Message part 1 (text/plain, inline)]

Source: vcmi
Version: 1.1.0+dfsg-1
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

The build year is embedded inside various binaries as a copyright
declaration. This not only makes the package unreproducible, it is
inaccurate, as the build process does not generate any copyrightable
content.

The attached patch fixes this from by replacing the year with "present".

According to my local tests, with this patch applied (and build paths
held constant), vcmi should build reproducibly! (The salsa reprotest job
has both time and build_path variations disabled, apparently)

Thanks for maintaining vcmi!

live well,
  vagrant

[0001-Replace-build-year-with-present-in-copyright-declara.patch (text/x-diff, inline)]

From 88deb6fa589aeafc374ac1f9bb7875e5cc7b0548 Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Mon, 8 May 2023 14:07:29 -0700
Subject: [PATCH 1/2] Replace build year with "present" in copyright
 declarations.

Embedding the build year breaks reproducible builds and the
auto-generated copyright years are inaccurate, as it is the year the
package was built, not when the copyrightable content was created.

https://reproducible-builds.org/docs/timestamps/
---
 client/CMT.cpp         | 2 +-
 server/CVCMIServer.cpp | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/CMT.cpp b/client/CMT.cpp
index 25c5c8f..9002b1b 100644
--- a/client/CMT.cpp
+++ b/client/CMT.cpp
@@ -141,7 +141,7 @@ static void prog_help(const po::options_description &opts)
 {
 	auto time = std::time(0);
 	printf("%s - A Heroes of Might and Magic 3 clone\n", GameConstants::VCMI_VERSION.c_str());
-	printf("Copyright (C) 2007-%d VCMI dev team - see AUTHORS file\n", std::localtime(&time)->tm_year + 1900);
+	printf("Copyright (C) 2007-present VCMI dev team - see AUTHORS file\n");
 	printf("This is free software; see the source for copying conditions. There is NO\n");
 	printf("warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n");
 	printf("\n");
diff --git a/server/CVCMIServer.cpp b/server/CVCMIServer.cpp
index 63bd636..98b6b37 100644
--- a/server/CVCMIServer.cpp
+++ b/server/CVCMIServer.cpp
@@ -1025,7 +1025,7 @@ static void handleCommandOptions(int argc, char * argv[], boost::program_options
 	{
 		auto time = std::time(0);
 		printf("%s - A Heroes of Might and Magic 3 clone\n", GameConstants::VCMI_VERSION.c_str());
-		printf("Copyright (C) 2007-%d VCMI dev team - see AUTHORS file\n", std::localtime(&time)->tm_year + 1900);
+		printf("Copyright (C) 2007-present VCMI dev team - see AUTHORS file\n");
 		printf("This is free software; see the source for copying conditions. There is NO\n");
 		printf("warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n");
 		printf("\n");
-- 
2.39.2

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.