Debian Bug report logs - #750697
PEAR: Timestamp in registry files prevent reproducible builds

version graph

Package: php-pear; Maintainer for php-pear is Debian PHP Maintainers <team+pkg-php@tracker.debian.org>; Source for php-pear is src:php-pear (PTS, buildd, popcon).

Affects: src:php-htmlpurifier, pkg-php-tools

Reported by: Mathieu Parent <math.parent@gmail.com>

Date: Thu, 5 Jun 2014 20:27:02 UTC

Severity: important

Tags: confirmed, upstream

Fixed in version php-pear/1:1.10.9+submodules+notgz-1

Done: Mathieu Parent <sathieu@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to debian-bugs-dist@lists.debian.org, Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>:
Bug#750697; Package pkg-php-tools. (Thu, 05 Jun 2014 20:27:06 GMT) (full text, mbox, link).

Acknowledgement sent to Mathieu Parent <math.parent@gmail.com>:
New Bug report received and forwarded. Copy sent to Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>. (Thu, 05 Jun 2014 20:27:06 GMT) (full text, mbox, link).

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Mathieu Parent <math.parent@gmail.com>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: PEAR: Timestamp in registry files prevent reproducible builds
Date: Thu, 05 Jun 2014 22:25:39 +0200
Package: pkg-php-tools
Version: 1.11
Severity: wishlist

Hello,

All /usr/share/php/.registry/*.reg include a timestamp. It should be replaced
by the changelog timestamp, or removed.

This can be done by changing the _lastmodified element of the array before
serializing.

More info at:
https://wiki.debian.org/ReproducibleBuilds/TimestampInPhpRegistryFiles

NB: This is a 'not to forget' bug

Cheers

Mathieu



-- System Information:
Debian Release: jessie/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 3.13-1-686-pae (SMP w/1 CPU core)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages pkg-php-tools depends on:
ii  debhelper  9.20140228
ii  php-pear   5.6.0~beta3+dfsg-2
ii  php5-cli   5.6.0~beta3+dfsg-2
ii  php5-json  1.3.5-2

pkg-php-tools recommends no packages.

Versions of packages pkg-php-tools suggests:
ii  dh-make  0.63

-- no debconf information

Added tag(s) confirmed. Request was from Mathieu Parent <math.parent@gmail.com> to control@bugs.debian.org. (Sat, 04 Oct 2014 05:09:05 GMT) (full text, mbox, link).

Information forwarded to debian-bugs-dist@lists.debian.org, Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>:
Bug#750697; Package pkg-php-tools. (Tue, 03 Feb 2015 16:33:10 GMT) (full text, mbox, link).

Acknowledgement sent to Chris Lamb <lamby@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>. (Tue, 03 Feb 2015 16:33:10 GMT) (full text, mbox, link).

Message #12 received at 750697@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>
To: 750697@bugs.debian.org
Subject: Re: PEAR: Timestamp in registry files prevent reproducible builds
Date: Tue, 03 Feb 2015 16:31:30 +0000
user reproducible-builds@lists.alioth.debian.org
usertags toolchain
thanks

> This can be done by changing the _lastmodified element of the
> array before serializing.

See also:

  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776138

Also, I think this bug should be filed against the main PHP/PEAR
package, not pkg-php-tools as that's where the serialisation happens. I
went to patch the former but it became a little invasive; multiple
places to change etc.


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Added tag(s) upstream. Request was from Mathieu Parent <sathieu@debian.org> to control@bugs.debian.org. (Tue, 27 Dec 2016 07:09:04 GMT) (full text, mbox, link).

Information forwarded to debian-bugs-dist@lists.debian.org, Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>:
Bug#750697; Package pkg-php-tools. (Thu, 14 Jun 2018 05:09:03 GMT) (full text, mbox, link).

Acknowledgement sent to Mathieu Parent <math.parent@gmail.com>:
Extra info received and forwarded to list. Copy sent to Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>. (Thu, 14 Jun 2018 05:09:03 GMT) (full text, mbox, link).

Message #19 received at 750697@bugs.debian.org (full text, mbox, reply):

From: Mathieu Parent <math.parent@gmail.com>
To: 750697@bugs.debian.org
Subject: Reassigning to php-pear
Date: Thu, 14 Jun 2018 07:05:06 +0200
Control: reassign -1 php-pear
Control: affects -1 pkg-php-tools

As per comment #12.

Regards
-- 
Mathieu Parent

Bug reassigned from package 'pkg-php-tools' to 'php-pear'. Request was from Mathieu Parent <math.parent@gmail.com> to 750697-submit@bugs.debian.org. (Thu, 14 Jun 2018 05:09:03 GMT) (full text, mbox, link).

No longer marked as found in versions pkg-php-tools/1.11. Request was from Mathieu Parent <math.parent@gmail.com> to 750697-submit@bugs.debian.org. (Thu, 14 Jun 2018 05:09:04 GMT) (full text, mbox, link).

Added indication that 750697 affects pkg-php-tools Request was from Mathieu Parent <math.parent@gmail.com> to 750697-submit@bugs.debian.org. (Thu, 14 Jun 2018 05:09:04 GMT) (full text, mbox, link).

Severity set to 'important' from 'wishlist' Request was from Thorsten Glaser <tg@debian.org> to control@bugs.debian.org. (Thu, 14 Mar 2019 17:15:02 GMT) (full text, mbox, link).

Added indication that 750697 affects src:php-htmlpurifier Request was from Thorsten Glaser <tg@debian.org> to control@bugs.debian.org. (Thu, 14 Mar 2019 17:15:03 GMT) (full text, mbox, link).

Reply sent to Mathieu Parent <sathieu@debian.org>:
You have taken responsibility. (Thu, 01 Aug 2019 21:54:09 GMT) (full text, mbox, link).

Notification sent to Mathieu Parent <math.parent@gmail.com>:
Bug acknowledged by developer. (Thu, 01 Aug 2019 21:54:09 GMT) (full text, mbox, link).

Message #34 received at 750697-close@bugs.debian.org (full text, mbox, reply):

From: Mathieu Parent <sathieu@debian.org>
To: 750697-close@bugs.debian.org
Subject: Bug#750697: fixed in php-pear 1:1.10.9+submodules+notgz-1
Date: Thu, 01 Aug 2019 21:50:49 +0000
Source: php-pear
Source-Version: 1:1.10.9+submodules+notgz-1

We believe that the bug you reported is fixed in the latest version of
php-pear, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 750697@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mathieu Parent <sathieu@debian.org> (supplier of updated php-pear package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 01 Aug 2019 23:15:22 +0200
Source: php-pear
Architecture: source
Version: 1:1.10.9+submodules+notgz-1
Distribution: unstable
Urgency: low
Maintainer: Debian PHP Maintainers <team+pkg-php@tracker.debian.org>
Changed-By: Mathieu Parent <sathieu@debian.org>
Closes: 750697 890433
Changes:
 php-pear (1:1.10.9+submodules+notgz-1) unstable; urgency=low
 .
   [ Ondřej Surý ]
   * Update PEAR to 1.10.8
   * Update Archive_Tar to 1.4.6
   * Update Console_Getopt to 1.4.2
   * Update maintainer address
   * Update gbp.conf for salsa and enable pristine-tar
   * Bump policy to recent version (no change)
 .
   [ Mathieu Parent ]
   * Update PEAR to 1.10.9
     - Fixes count() on non Countable (Closes: #890433)
   * Update Archive_Tar to 1.4.7
   * Update Structures_Graph to v1.1.1 + 1 minor patch
   * Add debian/README.source
   * Fix package-uses-deprecated-source-override-location
   * Fix insecure-copyright-format-uri
   * Fix debian-watch-uses-insecure-uri
   * Bump debhelper compat to 12
   * Update debian/php-pear.substvars-static
   * Fix manpage-has-errors-from-man
   * Standards-Version: 4.4.0
   * Add debian/salsa-ci.yml
   * Implement the SOURCE_DATE_EPOCH specification (Closes: #750697)
Checksums-Sha1:
 9ca96e74e0e542852a2dd58ca656d2471c8db5b4 2110 php-pear_1.10.9+submodules+notgz-1.dsc
 6c9ba14210ca4a020eecef8d90e7f2c4ef62f13b 2213253 php-pear_1.10.9+submodules+notgz.orig.tar.gz
 a4bf1037b8a9ae048c4eb8b59b79a70eb4128a10 7784 php-pear_1.10.9+submodules+notgz-1.debian.tar.xz
 aa9983959449faa9299962ea9e2ae4e7913df5cb 5850 php-pear_1.10.9+submodules+notgz-1_source.buildinfo
Checksums-Sha256:
 8402a0eb07246d31f049b8d6f28f50291d9cbc981c1dcadc691d7a1fb2c1b5c1 2110 php-pear_1.10.9+submodules+notgz-1.dsc
 d138578f93aaf595846e92b5bf5e1b65a5113c823d6fb9ee43138e55cd426c91 2213253 php-pear_1.10.9+submodules+notgz.orig.tar.gz
 39de2c0f81a520d43c9488b00df41022109be55335d9c6773fd3af9e2d677aca 7784 php-pear_1.10.9+submodules+notgz-1.debian.tar.xz
 53029dd546e0769c07c8c0c0708a271d19c1e2906bb08f475c43a4d224668027 5850 php-pear_1.10.9+submodules+notgz-1_source.buildinfo
Files:
 b5bd8ed677588d5f9c84f960289bc5d1 2110 php optional php-pear_1.10.9+submodules+notgz-1.dsc
 0e4eaf0d0e473e31125b591412820c5e 2213253 php optional php-pear_1.10.9+submodules+notgz.orig.tar.gz
 28fdce61081217168a358079888c62a4 7784 php optional php-pear_1.10.9+submodules+notgz-1.debian.tar.xz
 4c2c9d3bd60dbc3e2a772f3af28840df 5850 php optional php-pear_1.10.9+submodules+notgz-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJHBAEBCgAxFiEEqqWLhC6ILPQU4Lqxp8cqHHgrjD8FAl1DWdcTHHNhdGhpZXVA
ZGViaWFuLm9yZwAKCRCnxyoceCuMP4smD/9J3+WYQOOn+5JWvbMgR0wEHORYjwJA
GpnbyvdA1PelrGV3kQJzaHw9Rp9r91jH0o9wiMNRTfpfOEwu22ZmbGnzp3j4mL2S
zsvC5E4BKppo1Efk8Bw/sMY1CCIfoWHlwlh6yCS4Xa3EjwpJe3EYm/0QSOyilAgI
WWS7X8Itfr0C5zrEs62gZU5GNWQpbYQtifEjjGFmgQQPLLlcrhWeQboD/aOwyci9
KhaM23/z/eHRCo2QFuYEmQEejm2AkyivUCYEaHG58DhkZzk/jEHO2w4VRpuhqlPW
AXXK469cEIKZxgKqdZNnIkcBiVWwvYHtRARWlZTVWEaag6kHfhDdvQYD6uKENTi8
6ld2y0HOqX/Is3BgCt7TMY/PDFLNAyGEY4gtVLCLjWs71idnlcTG1KSD9vUobEpE
6HWVVL2Xm0As372eORknGBUU+1LOl6P15fUky3/wVCD2I0D/5W+ArgbXRZ36R6G9
gIKqCb11UWB6b6W2wwJJTg3wYAVxKscs9fLusVOqSSKVpsz7xVJewAGIsfhnAKoQ
jRHZmnsDc2JjJ6uOeBQYo2eWEUpNWMqA2NYiq8OAXEU5F0eYnB6kXAJtOd8OGBt+
/ehtVkARVSZxQeQEzfJmwWtXC16CtcOOheTKM9zIhW16c7tWdwUxwQOZrUywcznp
5idgU4DJ2GtzJQ==
=KMBN
-----END PGP SIGNATURE-----

Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Fri, 30 Aug 2019 07:37:05 GMT) (full text, mbox, link).

Send a report that this bug log contains spam.

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed May 17 14:10:19 2023; Machine Name: bembo

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.