Debian Bug report logs - #806494
gnupg: please make the build reproducible

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: submit@bugs.debian.org

Subject: gnupg: please make the build reproducible

Date: Fri, 27 Nov 2015 23:51:09 +0200

[Message part 1 (text/plain, inline)]

Source: gnupg
Version: 1.4.19-6
Severity: wishlist
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-builds@lists.alioth.debian.org

Hi,

Whilst working on the "reproducible builds" effort [0], we noticed that
gnupg could not be built reproducibly.

The attached patch removes timestamps from the "yat2m" manpage
generator. Once applied, gnupg can be built reproducibly using our
reproducible toolchain.

 [0] https://wiki.debian.org/ReproducibleBuilds


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

[gnupg.diff.txt (text/plain, attachment)]

Message #10 received at 806494@bugs.debian.org (full text, mbox, reply):

From: Reiner Herrmann <reiner@reiner-h.de>

To: Chris Lamb <lamby@debian.org>, 806494@bugs.debian.org, Reproducible Builds discussion list <reproducible-builds@lists.alioth.debian.org>

Subject: Re: [Reproducible-builds] Bug#806494: gnupg: please make the build reproducible

Date: Sun, 29 Nov 2015 01:47:30 +0100

[Message part 1 (text/plain, inline)]

Control: affects -1 + libgpg-error gnupg2 libgcrypt20

On Fri, Nov 27, 2015 at 11:51:09PM +0200, Chris Lamb wrote:
> The attached patch removes timestamps from the "yat2m" manpage
> generator. Once applied, gnupg can be built reproducibly using our
> reproducible toolchain.

The packages libgpg-error, gnupg2 and libgcrypt20 are also affected
by the same problem.

Please apply lamby's patch there too.

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 806494@bugs.debian.org (full text, mbox, reply):

From: Werner Koch <wk@gnupg.org>

To: Chris Lamb <lamby@debian.org>

Cc: 806494@bugs.debian.org

Subject: Re: [pkg-gnupg-maint] Bug#806494: gnupg: please make the build reproducible

Date: Mon, 30 Nov 2015 11:53:15 +0100

On Fri, 27 Nov 2015 22:51, lamby@debian.org said:

> The attached patch removes timestamps from the "yat2m" manpage
> generator. Once applied, gnupg can be built reproducibly using our

Can you please explain the envvar SOURCE_DATE_EPOCH and from what value
it is derived.  For the texi manuals we use the mkdefsinc tool to create
a file defsincdate with the lates epoch of all files derived from Git.
That file is distributed and then used for the date.  The same should be
done for the man pages.  No need for the above envvar.

The patch is anyway not portable; for example it uses strtoull and other
C99 features.  yat2m needs to plain C90.

I just pushed two commits:

  081c902 doc: Build man pages with the same date as the info files.
  75eb071 yat2m: New option --date.

which should fix the problem.


Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.

Message #22 received at 806494@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: Werner Koch <wk@gnupg.org>

Cc: 806494@bugs.debian.org

Subject: Re: [pkg-gnupg-maint] Bug#806494: gnupg: please make the build reproducible

Date: Mon, 30 Nov 2015 13:06:43 +0200

Hi Werner,

> Can you please explain the envvar SOURCE_DATE_EPOCH and from what value
> it is derived.

Would it be okay to direct you to its canonical specification rather
than repeat it here? ie.
<https://reproducible-builds.org/specs/source-date-epoch/>

> The patch is anyway not portable; for example it uses strtoull and other
> C99 features.  yat2m needs to plain C90.

Ah, okay. Retro, but makes sense.

>   081c902 doc: Build man pages with the same date as the info files.
>   75eb071 yat2m: New option --date.

Great :)


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #27 received at 806494@bugs.debian.org (full text, mbox, reply):

From: Werner Koch <wk@gnupg.org>

To: Chris Lamb <lamby@debian.org>

Cc: 806494@bugs.debian.org

Subject: Re: [pkg-gnupg-maint] Bug#806494: gnupg: please make the build reproducible

Date: Mon, 30 Nov 2015 16:27:14 +0100

On Mon, 30 Nov 2015 12:06, lamby@debian.org said:

> than repeat it here? ie.
> <https://reproducible-builds.org/specs/source-date-epoch/>

Thanks.

> Ah, okay. Retro, but makes sense.

[ yat2m shall be able to run on all platforms and thus it need to
  restrict itself to a common subset.  For example VMS and many toolkits
  for embedded platforms do not provide C99.  It is easy enough to keep
  yat2m at this langugae level. ]

>>   75eb071 yat2m: New option --date.
>
> Great :)

will be in 2.1.10 hopefully this week.


Shalom-Salam,

   Werner


-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.

Message #32 received at 806494@bugs.debian.org (full text, mbox, reply):

From: Petter Reinholdtsen <pere@hungry.com>

To: Werner Koch <wk@gnupg.org>

Cc: Chris Lamb <lamby@debian.org>, 806494@bugs.debian.org

Subject: Re: [pkg-gnupg-maint] Bug#806494: gnupg: please make the build reproducible

Date: Wed, 17 Feb 2016 15:47:35 +0100

[Werner Koch 2015-11-30]
> will be in 2.1.10 hopefully this week.

I guess something is still missing, as gnupg is still not reproducable
according to the tests.  The only difference reported by the test
framework is a date in gpgv.1.gz.  Was this file forgotten when the
package was fixed?

-- 
Happy hacking
Petter Reinholdtsen

Message #37 received at 806494@bugs.debian.org (full text, mbox, reply):

From: intrigeri <intrigeri@debian.org>

To: 806494@bugs.debian.org

Cc: Petter Reinholdtsen <pere@hungry.com>, Chris Lamb <lamby@debian.org>

Subject: Re: Bug#806494: gnupg: please make the build reproducible

Date: Sat, 04 Jun 2016 14:25:52 +0200

Hi,

Petter Reinholdtsen wrote (17 Feb 2016 14:47:35 GMT) :
> [Werner Koch 2015-11-30]
>> will be in 2.1.10 hopefully this week.

> I guess something is still missing, as gnupg is still not reproducable
> according to the tests.  The only difference reported by the test
> framework is a date in gpgv.1.gz.  Was this file forgotten when the
> package was fixed?

Upstream 2.1.10 added a new --date option to yat2m, but GnuPG 1.4.20
did not get it yet. I guess that's why gpgv.1 still has a timestamp
that depends on the build time.

Werner, could this change be backported to GnuPG 1.x? (I do realize
that it's not merely about ya2tm.c, since e.g. doc/Makefile.am is
also affected.)

Cheers,
--
intrigeri

Message #42 received at 806494@bugs.debian.org (full text, mbox, reply):

From: Werner Koch <wk@gnupg.org>

To: intrigeri <intrigeri@debian.org>

Cc: 806494@bugs.debian.org, Petter Reinholdtsen <pere@hungry.com>, Chris Lamb <lamby@debian.org>

Subject: Re: Bug#806494: gnupg: please make the build reproducible

Date: Sat, 04 Jun 2016 18:23:11 +0200

On Sat,  4 Jun 2016 14:25, intrigeri@debian.org said:

> Werner, could this change be backported to GnuPG 1.x? (I do realize
> that it's not merely about ya2tm.c, since e.g. doc/Makefile.am is
> also affected.)

If it is only to update yat2m and a small fix in the Makefile, a tested
patch would be appreciated.


Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.
    /* EFH in Erkrath: https://alt-hochdahl.de/haus */

Message #47 received at 806494@bugs.debian.org (full text, mbox, reply):

From: intrigeri <intrigeri@debian.org>

To: 806494@bugs.debian.org

Cc: Petter Reinholdtsen <pere@hungry.com>, Chris Lamb <lamby@debian.org>

Subject: Re: Bug#806494: gnupg: please make the build reproducible

Date: Sun, 05 Jun 2016 13:07:34 +0200

[Message part 1 (text/plain, inline)]

Control: tag -1 + patch

Hi,

Werner Koch wrote (04 Jun 2016 16:23:11 GMT) :
> On Sat,  4 Jun 2016 14:25, intrigeri@debian.org said:

>> Werner, could this change be backported to GnuPG 1.x? (I do realize
>> that it's not merely about ya2tm.c, since e.g. doc/Makefile.am is
>> also affected.)

> If it is only to update yat2m and a small fix in the Makefile, a tested
> patch would be appreciated.

I gave it a try and AFAICT it won't be a small fix in the Makefile:
the yat2m-stamp changes depend on defs.inc, defsincdate, mkdefsinc and
friends. Then mkdefsinc.c imported from the v2.x tree does not compile
as-is. I gave up at that point, and I'm not convinced that it's worth
investing more time to fix this upstream in the v1.x tree, given that
the problem is solved in the v2.x one already.

So, maybe it's acceptable to carry a very simple Debian-only solution
for GnuPG v1.x, until it is fully replaced by v2.x? The attached patch
does that, by updating yat2m to the one included in 2.1.11, and
patching doc/Makefile.am to pass it --date $SOURCE_DATE_EPOCH
(initialized in debian/rules for now).

Cheers,
-- 
intrigeri

[0001-Make-man-pages-not-embed-a-build-time-dependent-time.patch (text/x-diff, attachment)]

Message #52 received at 806494@bugs.debian.org (full text, mbox, reply):

From: Werner Koch <wk@gnupg.org>

To: intrigeri <intrigeri@debian.org>

Cc: 806494@bugs.debian.org

Subject: Re: [pkg-gnupg-maint] Bug#806494: gnupg: please make the build reproducible

Date: Sun, 05 Jun 2016 21:52:49 +0200

On Sun,  5 Jun 2016 13:07, intrigeri@debian.org said:

> I gave it a try and AFAICT it won't be a small fix in the Makefile:
> the yat2m-stamp changes depend on defs.inc, defsincdate, mkdefsinc and
> friends. Then mkdefsinc.c imported from the v2.x tree does not compile

Right, I feared that there was some more complicated stuff. 

> So, maybe it's acceptable to carry a very simple Debian-only solution
> for GnuPG v1.x, until it is fully replaced by v2.x? The attached patch

I'd say, go for it.


Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.
    /* EFH in Erkrath: https://alt-hochdahl.de/haus */

Message #57 received at 806494@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: 806494@bugs.debian.org

Subject: Re: gnupg: please make the build reproducible

Date: Sun, 14 Aug 2016 02:08:41 +0100

affects -1 + gnupg1
thanks

> gnupg: please make the build reproducible

(And gnupg1 now after rename..)


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #64 received at 806494@bugs.debian.org (full text, mbox, reply):

From: Petter Reinholdtsen <pere@hungry.com>

To: Werner Koch <wk@gnupg.org>, intrigeri <intrigeri@debian.org>, 806494@bugs.debian.org

Subject: Re: Bug#806494: gnupg: please make the build reproducible

Date: Tue, 16 Aug 2016 21:48:26 +0200

[intrigeri@debian.org 2016-06-05]
> So, maybe it's acceptable to carry a very simple Debian-only solution
> for GnuPG v1.x, until it is fully replaced by v2.x? The attached patch
 
[Werner Koch 2016-06-05]
> I'd say, go for it.

Is there something missing with this patch causing it to not be applied?
I am tracking the packages used by the FreedomBox to try to get the
entire FreedomBox system to use reproducably built packages, and gnupg is
one of the few remaining ones.

<URL: https://tests.reproducible-builds.org/debian/testing/amd64/pkg_set_freedombox.html >
show the remaining 53 packages, where gnupg and libgpg-error are gpg related.

-- 
Happy hacking
Petter Reinholdtsen

Message #69 received at 806494-submitter@bugs.debian.org (full text, mbox, reply):

From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

To: 806494-submitter@bugs.debian.org

Subject: Bug#806494 marked as pending

Date: Mon, 29 Aug 2016 14:48:50 +0000

tag 806494 pending
thanks

Hello,

Bug #806494 reported by you has been fixed in the Git repository. You can
see the changelog below, and you can check the diff of the fix at:

    http://git.debian.org/?p=pkg-gnupg/gnupg1.git;a=commitdiff;h=2147d7b

---
commit 2147d7bd53244662453cffc9c25604e2e265a2ca
Author: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date:   Mon Aug 29 10:04:21 2016 -0400

    prepare release

diff --git a/debian/changelog b/debian/changelog
index 586c73e..a0c099f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+gnupg1 (1.4.21-1) unstable; urgency=medium
+
+  * new upstream release (Closes: #834893)
+  * drop already upstreamed patches, refresh remainder
+  * build reproducibly (Closes: #806494)
+  * gnupg1 is Priority: extra (Closes: #834757)
+
+ -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Mon, 29 Aug 2016 10:03:15 -0400
+
 gnupg1 (1.4.20-7) unstable; urgency=medium
 
   * Release to unstable.

Message #74 received at 806494-close@bugs.debian.org (full text, mbox, reply):

From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

To: 806494-close@bugs.debian.org

Subject: Bug#806494: fixed in gnupg1 1.4.21-1

Date: Mon, 29 Aug 2016 16:21:10 +0000

Source: gnupg1
Source-Version: 1.4.21-1

We believe that the bug you reported is fixed in the latest version of
gnupg1, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 806494@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Daniel Kahn Gillmor <dkg@fifthhorseman.net> (supplier of updated gnupg1 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 29 Aug 2016 10:03:15 -0400
Source: gnupg1
Binary: gnupg1 gnupg1-curl gpgv1 gpgv1.4-udeb gnupg1-l10n
Architecture: source
Version: 1.4.21-1
Distribution: unstable
Urgency: medium
Maintainer: Debian GnuPG-Maintainers <pkg-gnupg-maint@lists.alioth.debian.org>
Changed-By: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Description:
 gnupg1     - GNU privacy guard - a free PGP replacement ("classic" version)
 gnupg1-curl - GNU privacy guard - a free PGP replacement (cURL helpers for "cla
 gnupg1-l10n - GNU privacy guard "classic" - localization files
 gpgv1      - GNU privacy guard - signature verification tool ("classic" versio
 gpgv1.4-udeb - minimal signature verification tool (udeb)
Closes: 806494 834757 834893
Changes:
 gnupg1 (1.4.21-1) unstable; urgency=medium
 .
   * new upstream release (Closes: #834893)
   * drop already upstreamed patches, refresh remainder
   * build reproducibly (Closes: #806494)
   * gnupg1 is Priority: extra (Closes: #834757)
Checksums-Sha1:
 dd110e2a95020d1f765cdd4d4e7a5f96d5ad5534 2474 gnupg1_1.4.21-1.dsc
 e3bdb585026f752ae91360f45c28e76e4a15d338 3689305 gnupg1_1.4.21.orig.tar.bz2
 0669b04a617b7d91c1e69d7565748efa6393eba4 32836 gnupg1_1.4.21-1.debian.tar.xz
Checksums-Sha256:
 9c0b7672cf68070b715a9694d656bc759b790b4754252046a33b4d06c083e51c 2474 gnupg1_1.4.21-1.dsc
 6b47a3100c857dcab3c60e6152e56a997f2c7862c1b8b2b25adf3884a1ae2276 3689305 gnupg1_1.4.21.orig.tar.bz2
 20648f68e91b54e7cabbec6cf219be70b6a84c2d8ead4522077a227f1f3717a0 32836 gnupg1_1.4.21-1.debian.tar.xz
Files:
 8e76e0b7deded18e37b615db34d1e14a 2474 utils extra gnupg1_1.4.21-1.dsc
 9bdeabf3c0f87ff21cb3f9216efdd01d 3689305 utils extra gnupg1_1.4.21.orig.tar.bz2
 3ff8c347d12a2d55685beffb8dfe9739 32836 utils extra gnupg1_1.4.21-1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9BQJXxErOXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRFREIyRTc0RjU2RkNGMkI2NzI5N0I3MzUy
NEVDRkY1QUZGNjgzNzBBFhxka2dAZmlmdGhob3JzZW1hbi5uZXQACgkQJOz/Wv9o
NwqJbw/+LJRypGZjQQdOEb5LXkUolyNmKL90nRf30p4ANFnaXgLsMnyIt2PreU5y
SL/bTfzzlPu0CzRll1/qmyvRVOh4To6UepbmdE9T9fzqduzmXUrl1ijs3pD6lv19
NmXNuYDgyWdyOpbTmYdPPKhUqalEwusFSl7W2+jFCCKcINrM+v7cwVnGqQEt3U7m
onICZVXZLrxbdrT6dgp4JRzvMT/cKdPgsMSJM1oxZ0tHJyflqQKb+WLyFLxPvJgL
NzOha/aCpyAN0L9NlnBgjYMRk5VXWAXS/iCBlBmXAG9rDhYZnQjEaV/OyUOaae2E
AhdC1MdgPJFVqWQDe0sraUAmeKUlsl1Adu/AQCUYLhqZCr/VdNuaTB/LW4dlTg/P
J46cEPuW+1xyceKRWATrV93hkX0eZc1OrhtRNjfFbexNfY4r54jut9g5CLTC7Lbd
57Kmyg9WqUXKUjs2XeU931tHCGrWm1uJxNWNT8GOMqKl+M5hRXfvepBA2wI4Ugy6
uv/6+/bzu9nDzlmfOTjyeqj0YQENRk8jnffCZdfSWzcEirD6QLCzlsVUkMkse9/U
Pg8Rsa0J0m7AyDEPvHAqfNE03jVY7anHU7dr1iyK5phOjaibnC7in3jkQ2TBTlo7
eGixaK0/SY3DDRoOljXwapwMSDhR5DIeUgn55cz5AD/TFbwVI0s=
=kj7I
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.