Debian Bug report logs - #829765
mrd6: please make the build reproducible

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Reiner Herrmann <reiner@reiner-h.de>

To: submit@bugs.debian.org

Subject: mrd6: please make the build reproducible

Date: Tue, 5 Jul 2016 22:20:33 +0200

[Message part 1 (text/plain, inline)]

Source: mrd6
Version: 0.9.6-12
Severity: wishlist
Tags: patch upstream
User: reproducible-builds@lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-builds@lists.alioth.debian.org

Hi!

While working on the "reproducible builds" effort [1], we have noticed
that mrd6 could not be built reproducibly.
It embeds the build date into the binary.

The attached patch strips this to enable reproducible building.

Regards,
 Reiner

[1]: https://wiki.debian.org/ReproducibleBuilds

[mrd6.patch (text/x-diff, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 829765@bugs.debian.org (full text, mbox, reply):

From: Thomas Preud'homme <thomas.preudhomme@celest.fr>

To: Reiner Herrmann <reiner@reiner-h.de>, 829765@bugs.debian.org

Subject: Re: Bug#829765: mrd6: please make the build reproducible

Date: Sat, 09 Jul 2016 22:34:10 +0100

[Message part 1 (text/plain, inline)]

Le Tuesday 05 July 2016, 22:20:33 Reiner Herrmann a écrit :
> Source: mrd6
> Version: 0.9.6-12
> Severity: wishlist
> Tags: patch upstream
> User: reproducible-builds@lists.alioth.debian.org
> Usertags: timestamps
> X-Debbugs-Cc: reproducible-builds@lists.alioth.debian.org
> 
> Hi!

Hi Reiner,

> 
> While working on the "reproducible builds" effort [1], we have noticed
> that mrd6 could not be built reproducibly.
> It embeds the build date into the binary.
> 
> The attached patch strips this to enable reproducible building.

Thanks for the patch! Why remove the build date in src/mrd.cpp since it's 
already made reproducible by using unknown instead of the date? I suspect 
upstream will want to keep the date for normal build and I could make the 
change in the Makefile to be conditional on some variable, allowing Debian 
build to be reproducible while keeping the build unchanged for other usage.

Best regards,

Thomas

[signature.asc (application/pgp-signature, inline)]

Message #15 received at 829765@bugs.debian.org (full text, mbox, reply):

From: Reiner Herrmann <reiner@reiner-h.de>

To: Thomas Preud'homme <thomas.preudhomme@celest.fr>

Cc: 829765@bugs.debian.org

Subject: Re: Bug#829765: mrd6: please make the build reproducible

Date: Sun, 10 Jul 2016 10:24:46 +0200

[Message part 1 (text/plain, inline)]

Hi Thomas,

On Sat, Jul 09, 2016 at 10:34:10PM +0100, Thomas Preud'homme wrote:
> > While working on the "reproducible builds" effort [1], we have noticed
> > that mrd6 could not be built reproducibly.
> > It embeds the build date into the binary.
> > 
> > The attached patch strips this to enable reproducible building.
> 
> Thanks for the patch! Why remove the build date in src/mrd.cpp since it's 
> already made reproducible by using unknown instead of the date? I suspect 
> upstream will want to keep the date for normal build and I could make the 
> change in the Makefile to be conditional on some variable, allowing Debian 
> build to be reproducible while keeping the build unchanged for other usage.

I also changed the build date to "unknown", or else the date would still
be part of the object file, even if it is no longer printed or used.
If upstream really insists on keeping the build date in (even though it
doesn't really provide any meaningful information), you could use the
__DATE__ / __TIME__ macros instead.
gcc supports replacing them with reproducible dates (based on the
SOURCE_DATE_EPOCH environment variable).
If you want, I can provide an updated patch for this.

Kind regards,
  Reiner

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 829765@bugs.debian.org (full text, mbox, reply):

From: Thomas Preud'homme <thomas.preudhomme@celest.fr>

To: Reiner Herrmann <reiner@reiner-h.de>, 829765@bugs.debian.org

Subject: Re: Bug#829765: mrd6: please make the build reproducible

Date: Sun, 07 Aug 2016 22:44:30 +0100

[Message part 1 (text/plain, inline)]

On dimanche 10 juillet 2016 10:24:46 BST Reiner Herrmann wrote:
> Hi Thomas,

Hi Reiner,

Sorry for the delay.

> 
> On Sat, Jul 09, 2016 at 10:34:10PM +0100, Thomas Preud'homme wrote:
> > > While working on the "reproducible builds" effort [1], we have noticed
> > > that mrd6 could not be built reproducibly.
> > > It embeds the build date into the binary.
> > > 
> > > The attached patch strips this to enable reproducible building.
> > 
> > Thanks for the patch! Why remove the build date in src/mrd.cpp since it's
> > already made reproducible by using unknown instead of the date? I suspect
> > upstream will want to keep the date for normal build and I could make the
> > change in the Makefile to be conditional on some variable, allowing Debian
> > build to be reproducible while keeping the build unchanged for other
> > usage.
> 
> I also changed the build date to "unknown", or else the date would still
> be part of the object file, even if it is no longer printed or used.
> If upstream really insists on keeping the build date in (even though it
> doesn't really provide any meaningful information), you could use the
> __DATE__ / __TIME__ macros instead.

My question was rather opposite. I understand the unknown, I don't understand 
why does it need to be removed from the object file.

> gcc supports replacing them with reproducible dates (based on the
> SOURCE_DATE_EPOCH environment variable).
> If you want, I can provide an updated patch for this.

No need, I can do it myself. I'll propose a patch removing the date altogether 
and see how it is received. By the way, I've just submitted the following pull 
request upstream:

https://github.com/hugosantos/mrd6/pull/30

Cheers,

Thomas

[signature.asc (application/pgp-signature, inline)]

Message #29 received at 829765@bugs.debian.org (full text, mbox, reply):

From: Thomas Preud'homme <robotux@debian.org>

To: 829765@bugs.debian.org

Cc: Reiner Herrmann <reiner@reiner-h.de>

Subject: Re: Bug#829765: mrd6: please make the build reproducible

Date: Tue, 09 Aug 2016 23:20:55 +0100

[Message part 1 (text/plain, inline)]

On dimanche 7 août 2016 22:44:30 BST Thomas Preud'homme wrote:
> On dimanche 10 juillet 2016 10:24:46 BST Reiner Herrmann wrote:
> > Hi Thomas,
> 
> Hi Reiner,
> 
> Sorry for the delay.
> 
> > On Sat, Jul 09, 2016 at 10:34:10PM +0100, Thomas Preud'homme wrote:
> > > > While working on the "reproducible builds" effort [1], we have noticed
> > > > that mrd6 could not be built reproducibly.
> > > > It embeds the build date into the binary.
> > > > 
> > > > The attached patch strips this to enable reproducible building.
> > > 
> > > Thanks for the patch! Why remove the build date in src/mrd.cpp since
> > > it's
> > > already made reproducible by using unknown instead of the date? I
> > > suspect
> > > upstream will want to keep the date for normal build and I could make
> > > the
> > > change in the Makefile to be conditional on some variable, allowing
> > > Debian
> > > build to be reproducible while keeping the build unchanged for other
> > > usage.
> > 
> > I also changed the build date to "unknown", or else the date would still
> > be part of the object file, even if it is no longer printed or used.
> > If upstream really insists on keeping the build date in (even though it
> > doesn't really provide any meaningful information), you could use the
> > __DATE__ / __TIME__ macros instead.
> 
> My question was rather opposite. I understand the unknown, I don't
> understand why does it need to be removed from the object file.
> 
> > gcc supports replacing them with reproducible dates (based on the
> > SOURCE_DATE_EPOCH environment variable).
> > If you want, I can provide an updated patch for this.
> 
> No need, I can do it myself. I'll propose a patch removing the date
> altogether and see how it is received. By the way, I've just submitted the
> following pull request upstream:
> 
> https://github.com/hugosantos/mrd6/pull/30

The pull request has been merged upstream. I want to fix the hardening info 
that lintian is throwing at me. Feel free to ping me if I haven't uploaded 
anything within one week and I'll upload what I got.

Best regards,

Thomas

[signature.asc (application/pgp-signature, inline)]

Message #34 received at 829765-close@bugs.debian.org (full text, mbox, reply):

From: Thomas Preud'homme <robotux@debian.org>

To: 829765-close@bugs.debian.org

Subject: Bug#829765: fixed in mrd6 0.9.6-13

Date: Thu, 01 Sep 2016 18:49:45 +0000

Source: mrd6
Source-Version: 0.9.6-13

We believe that the bug you reported is fixed in the latest version of
mrd6, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 829765@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Preud'homme <robotux@debian.org> (supplier of updated mrd6 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Thu, 01 Sep 2016 19:35:05 +0100
Source: mrd6
Binary: mrd6
Architecture: source amd64
Version: 0.9.6-13
Distribution: unstable
Urgency: medium
Maintainer: Thomas Preud'homme <robotux@debian.org>
Changed-By: Thomas Preud'homme <robotux@debian.org>
Description:
 mrd6       - IPv6 Multicast Routing Daemon
Closes: 829765
Changes:
 mrd6 (0.9.6-13) unstable; urgency=medium
 .
   * Make build reproducible (Closes: #829765, thanks Reiner Herrmann).
   * Bump Standards-Version to 3.9.8 (no changes needed).
   * debian/watch: use direct link to tags page rather than deprecated
     githubredir.
   * debian/control: use secure URL for Vcs-git.
Checksums-Sha1:
 92f1c40b1a0c688977cfccc917e8c7068b0509c6 1840 mrd6_0.9.6-13.dsc
 bd85670dac7996f7c005f43338c293facb268690 12840 mrd6_0.9.6-13.debian.tar.xz
 859b675338b54ec5eb16210ae84718c9a43cd90b 2469300 mrd6-dbgsym_0.9.6-13_amd64.deb
 412d4300c670bd34de62fecdf187a4de1e138fde 282728 mrd6_0.9.6-13_amd64.deb
Checksums-Sha256:
 a713ff14f2fe62d21a4410e895a27b76e96b089fb98df8683657eb9f7921c8cf 1840 mrd6_0.9.6-13.dsc
 db7914f283f58dcd66eb542b3b1a328607b00c3ed46e27456e9ecf88d06a3c41 12840 mrd6_0.9.6-13.debian.tar.xz
 bd18327d4128e3ccf01473d418b827c4db81010c07f082910136d9e048934cb0 2469300 mrd6-dbgsym_0.9.6-13_amd64.deb
 deb3dadae87db05c77003a1375e5868ea5adba8043582a8b0746c1849bb2b058 282728 mrd6_0.9.6-13_amd64.deb
Files:
 d62ae23cdef85cdc3e0de0edded94ea6 1840 net optional mrd6_0.9.6-13.dsc
 16ea81adaa40dbb552ae03b0b4e9ab0b 12840 net optional mrd6_0.9.6-13.debian.tar.xz
 96568e8a55d99cf44eca1f763d2fb7ea 2469300 debug extra mrd6-dbgsym_0.9.6-13_amd64.deb
 fdc9753538f3b4e0e36b06c9c32ca224 282728 net optional mrd6_0.9.6-13_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIcBAEBCAAGBQJXyHVxAAoJENADhS+9UlKeszQP/ijdfyNbSjSVGov1rImiWJEQ
knn360DrGyrDXB6dnLdtJeQIM0yHYxKRPAOs6U+lB1Owc6gR7pmLtQm5eGTNDldX
rD5SZi4gszOuKPxR+yWm/tDIT+hLmM+36IBQ8TZkdsiWAaQPT7PhYKLslimcgcwB
MH5i8Fd/QRIa6nk3QhfPuaVkUN/Um7R0qrWTMo2LFCMkwWH2e6ExlEg3OfO1RYAz
lse/Tl1hjjgQbwHI1GhJlHwNTuAUQG/7mBW6n35QWqhn3OROSqc/KSvulSdU1A08
v/+a+pLcncamRaa+x1S0C0PkpKDaxKxLESh29l5DDGNTcAAoyMobh4DdQfWtT3yf
4d8zDt/nfDOYnCjMEvGZIvlXDPUm5FTXmRfD6D/R8rpApLrsfonL+SpyqPOl6Iog
KDT5Otqw+/UY4B7N+cdpZT7LP/7Lwdq02scXmfOdNLzBCqOX21Teyrizz2czxhkw
QDoTv5z6/a90LjGjPOsY1759zUGJGz5Sp477dWsrDeFIoVbxXWAdMS/FKlUbKgDc
2OeTgqWynfc2eBtCRRfuL7tQx0+pecHR3QcW9SQLFPLeMl0ka2TXgnaCtD+YhkWN
ljnDutR+w4B0jqqSxX+T0JJjRoxhzwNPIMrAMY2a9NlszpO46q5VT5LZABicnl+Z
BeMdIP4XC1fG+wNijlrI
=kMV8
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.