Debian Bug report logs - #784602
please make monkeysign reproducible

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: please make monkeysign reproducible

Date: Thu, 07 May 2015 00:24:33 -0400

[Message part 1 (text/plain, inline)]

Source: monkeysign
Version: 2.0.2
Severity: wishlist
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: timestamps

monkeysign currently embeds the timestamp in its documentation.

The attached patch should fix the problem.

    --dkg

[0001-make-monkeysign-build-reproducibly.patch (text/x-diff, inline)]

From a38aef44ce7c256f0f948ff722844afa799f6d08 Mon Sep 17 00:00:00 2001
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Thu, 7 May 2015 00:18:19 -0400
Subject: [PATCH] make monkeysign build reproducibly

The man pages are currently generated with today's date.

This change makes them set with the date based off the BUILD_TIMESTAMP
environment variable, if that variable is set; it also adjusts
debian/rules to export that variable based on the last entry in
debian/changelog.
---
 debian/rules                | 5 +++++
 monkeysign/documentation.py | 3 ++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/debian/rules b/debian/rules
index a7baa54..01b4c9d 100755
--- a/debian/rules
+++ b/debian/rules
@@ -4,6 +4,11 @@
 # Uncomment this to turn on verbose mode.
 #export DH_VERBOSE=1
 
+LAST_CHANGE=$(shell dpkg-parsechangelog -S Date)
+BUILD_TIMESTAMP=$(shell LC_ALL=C date -u "+%s" -d "$(LAST_CHANGE)")
+
+export BUILD_TIMESTAMP
+
 # This has to be exported to make some magic below work.
 export DH_OPTIONS
 
diff --git a/monkeysign/documentation.py b/monkeysign/documentation.py
index d824738..2fa086e 100644
--- a/monkeysign/documentation.py
+++ b/monkeysign/documentation.py
@@ -4,6 +4,7 @@
 
 import os
 import datetime
+import time
 from distutils.command.build import build
 from distutils.core import Command
 from distutils.errors import DistutilsOptionError
@@ -28,7 +29,7 @@ class build_manpage(Command):
             raise DistutilsOptionError('\'output\' option is required')
         if self.parsers is None:
             raise DistutilsOptionError('\'parser\' option is required')
-        self._today = datetime.date.today()
+        self._today = datetime.date.fromtimestamp(float(os.getenv('BUILD_TIMESTAMP', time.time())))
         self._parsers = []
         for parser in self.parsers.split():
             scriptname, mod_name, func_name = parser.split(':')
-- 
2.1.4

Message #10 received at 784602@bugs.debian.org (full text, mbox, reply):

From: intrigeri <intrigeri@debian.org>

To: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

Cc: 784602@bugs.debian.org

Subject: Re: Bug#784602: please make monkeysign reproducible

Date: Sun, 03 Jul 2016 22:48:44 +0200

Hi,

Daniel Kahn Gillmor wrote (07 May 2015 04:24:33 GMT) :
> The attached patch should fix the problem.

This patch should be updated to use $SOURCE_DATE_EPOCH, I suppose.

Cheers,
--
intrigeri

Message #15 received at 784602@bugs.debian.org (full text, mbox, reply):

From: anarcat <anarcat@debian.org>

To: Daniel Kahn Gillmor <dkg@fifthhorseman.net>, intrigeri <intrigeri@debian.org>

Cc: 784602@bugs.debian.org

Subject: Re: [PATCH] make monkeysign build reproducibly

Date: Wed, 28 Sep 2016 08:34:12 -0400

[Message part 1 (text/plain, inline)]

Control: fixed 784602 2.1.0
Control: tags 784602 fixed-upstream

Thanks Daniel and intri for the patch and feedback. This was fixed in
the 2.1.0 release, I just overlooked that bug in the release process...

What I actually did was that I just ripped out the timestamp code from
the manpage generation process, which was rebuilt based on the new
argparse code. Unfortunately, that means loss of functionality and the
manpage is not as great as it was before.

We are considering other ways of maintaining the manpage, maybe through
Sphinx directly:

https://0xacab.org/monkeysphere/monkeysign/issues/47

... which would hopefully *not* trigger this issue again. :)

Cheers,

A.

-- 
You Are What You Is
                        - Frank Zappa

[signature.asc (application/pgp-signature, inline)]

Message #24 received at 784602-close@bugs.debian.org (full text, mbox, reply):

From: Antoine Beaupré <anarcat@debian.org>

To: 784602-close@bugs.debian.org

Subject: Bug#784602: fixed in monkeysign 2.1.1

Date: Wed, 28 Sep 2016 13:19:02 +0000

Source: monkeysign
Source-Version: 2.1.1

We believe that the bug you reported is fixed in the latest version of
monkeysign, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 784602@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Antoine Beaupré <anarcat@debian.org> (supplier of updated monkeysign package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Wed, 28 Sep 2016 08:18:24 -0400
Source: monkeysign
Binary: monkeysign monkeysign-doc
Architecture: source all
Version: 2.1.1
Distribution: unstable
Urgency: medium
Maintainer: Antoine Beaupré <anarcat@debian.org>
Changed-By: Antoine Beaupré <anarcat@debian.org>
Description:
 monkeysign - OpenPGP key signing and exchange for humans
 monkeysign-doc - OpenPGP key signing and exchange for humans (documentation)
Closes: 760139 773970 784602 839043
Changes:
 monkeysign (2.1.1) unstable; urgency=medium
 .
   * properly transition monkeysign-doc packages to ensure upgrades work
     (Closes: #839043)
   * add monkeysign-doc to Suggests
   * remove obsolete BUILD_TIMESTAMP, especially now that the manpage
     generation was rewritten without timestamps
   * improve release process and install documentation, remove presentation
   * forgot to close a bunch of issues in 2.1.0 release:
     * Monkeyscan fails at launch (Closes: #773970)
     * expiry date in epoch time is not human readable (Closes: #760139)
     * make builds reproducible (Closes: #784602)
Checksums-Sha1:
 cb77226f3d93097572f4f530b1cdaa98b3334956 1809 monkeysign_2.1.1.dsc
 8e53800871e472db6a7287e4fd2114e1d2113253 1137256 monkeysign_2.1.1.tar.xz
 662c21c1291eeb60cae4e73cec27130f06a39294 926064 monkeysign-doc_2.1.1_all.deb
 949cd8ed5de2ad5fb11d575fd1fcaef166b1cd54 74434 monkeysign_2.1.1_all.deb
Checksums-Sha256:
 f25237f80278d4d0735089a5c125ca095988797a9d7c664a029e11314db133d8 1809 monkeysign_2.1.1.dsc
 ba4b568f8a6be2966c5bbd39136af9908520ae8b0932780bcd17c5b99b87c721 1137256 monkeysign_2.1.1.tar.xz
 b54ba917c3307e509280aa137fedb5279f8de15aa1965372da703bf12a32153b 926064 monkeysign-doc_2.1.1_all.deb
 c9efebceff5787dd721638c90fe43c834e9b5502f139ab816f8a8d29df804c14 74434 monkeysign_2.1.1_all.deb
Files:
 068e24612c30817e55f4108f4801414f 1809 utils optional monkeysign_2.1.1.dsc
 d41e16dac9eb345c1ad96baaab632c39 1137256 utils optional monkeysign_2.1.1.tar.xz
 4458dc558d637fda3aeb79b0de3be13a 926064 doc optional monkeysign-doc_2.1.1_all.deb
 c5421e80f166cee6e32b2c71349aea10 74434 utils optional monkeysign_2.1.1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJX67+9AAoJEHkhUlJ7dZIeH34P/iRcGf8a/sUtfcApCFYStaZp
3JfcK1eGdO20uIoe+mS9cqAS8BLmyk9UwwiqixGrI8axRePE0TN9EO7wgX/oCqqm
AQydVqMrUGBEqAEYFFnEnfLtqlwI2s63GuvJilqo50bfFrKcN0ejfPAg6sIGamcx
dhNECpoRuJjNXsdoURS4Z3C59tTE0jynIDm3875iqOk8RMP0Ost7MLPNP6O2kYUo
AqqG1Yw7sv7s/ESZ+wOBOkJy2lwMh8FNRw8dukW122OYiUiVEtYnnkof+KB2UMFH
ZnysY8Bm/UosQmeV0ovRf59ShiJmLx1GQT1Yeg663EZlEajI+MVYcT8nUbqkCABO
7be0ddi/ydznteHa29IJI3bt+FPRoqMlDHedh5ikHpwliMo++DX8uYBBPQbgfYq8
Z5k1RJKZMUDFfGIs7r4xbg5Q5PTrSjfqwSkCVv0PRS2lReKOmq9Q/dPq69rKqeSO
UMBx23JrSzO8KXSSCzqoTDOooTxrvo0HeeXcFT3kpbl1NrH0CHbzi3xtkM/0swOc
+T6Cg2QSFXMQl5Cp8mOplp6g/HHr8qcv98JVBVvFwhvCAbu08U+5aAuF7p0qFoGo
coFPFKUcsxtYvw71Bt0gVef7huq18S4s3RkERiwG94M15OLAvbaG71JtNikQDqhe
yAL0ihLPZnfgzxcq3GcK
=fJrg
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.