Debian Bug report logs - #842875
lastpass-cli: please make the build reproducible

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Reiner Herrmann <reiner@reiner-h.de>

To: submit@bugs.debian.org

Subject: lastpass-cli: please make the build reproducible

Date: Wed, 2 Nov 2016 00:10:17 +0100

[Message part 1 (text/plain, inline)]

Source: lastpass-cli
Version: 1.0.0-1
Severity: wishlist
Tags: patch upstream
User: reproducible-builds@lists.alioth.debian.org
Usertags: fileordering
X-Debbugs-Cc: reproducible-builds@lists.alioth.debian.org
Forwarded: https://github.com/lastpass/lastpass-cli/pull/214

Hi!

While working on the "reproducible builds" effort [1], we have noticed
that lastpass-cli could not be built reproducibly.
It links objects in a non-deterministic order.

The attached patch fixes this by sorting the list of source files.

Regards,
 Reiner

[1]: https://wiki.debian.org/ReproducibleBuilds

[lastpass-cli.patch (text/x-diff, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #12 received at 842875-close@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: 842875-close@bugs.debian.org

Subject: Bug#842875: fixed in lastpass-cli 1.3.1-1

Date: Wed, 06 Jun 2018 10:07:39 +0000

Source: lastpass-cli
Source-Version: 1.3.1-1

We believe that the bug you reported is fixed in the latest version of
lastpass-cli, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 842875@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Chris Lamb <lamby@debian.org> (supplier of updated lastpass-cli package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Wed, 06 Jun 2018 10:31:22 +0100
Source: lastpass-cli
Binary: lastpass-cli
Architecture: source amd64
Version: 1.3.1-1
Distribution: unstable
Urgency: medium
Maintainer: Chris Lamb <lamby@debian.org>
Changed-By: Chris Lamb <lamby@debian.org>
Description:
 lastpass-cli - command line interface to LastPass.com
Closes: 842875 858991 898940
Changes:
 lastpass-cli (1.3.1-1) unstable; urgency=medium
 .
   * New upstream release. (Closes: #898940)
     - Use libssl-dev over libssl1.0-dev. (Closes: #858991)
     - Make the build reproducible. (Closes: #842875)
     - Add missing cmake and bash-completion to Build-Depends.
   * Take over maintenance of package - see <https://bugs.debian.org/898940#15>
     for blessing. Thanks to Troy Heber for his previous work on this package.
   * debian/rules:
     - Ensure full hardening even though we are using CMake by setting CFLAGS
       and CXXFLAGS from CPPFLAGS.
     - Install zsh completion script.
   * debian/control:
     - Drop Build-Depends on quilt; we are a 'quilt (3.0)' source format package.
     - Add Suggests: on xclip | xsel.
     - Add Recommends on pinentry-curses.
     - Add Vcs-{Git,Browser} & Homepage headers.
     - Bump Standards-Version to 4.1.4.
   * debian/patches:
     - Drop 0001-cipher-support-opaque-EVP_CIPHER_CTX,
       0002-cipher-drop-p8inf-broken-flag-check &
       0003-pbkdf2-support-openssl-1.1; applied upstream.
     - Replace 0004-build_manpage with an override in debian/rules to
       build lpass.1 manual page and fix location in debian/manpages.
   * Upstream are not providing signed tarballs so override the
     lintian warning debian-watch-does-not-check-gpg-signature.
   * Add some autopkgtest smoke tests.
   * Add a debian/watch file.
   * Bump to debhelper compatibility level 11.
   * Tidy debian/rules, drop empty debian/install file, apply "wrap-and-sort",
     drop whitespace from debian/changelog, re-order fields, drop trailing comma
     on DEB_BUILD_MAINT_OPTIONS line.
Checksums-Sha1:
 b20ee7b592addd72bb1c2ec40de9cf1a5578f224 2011 lastpass-cli_1.3.1-1.dsc
 0dfbecd1ac2a36af7cc24d714a0f3deb23a6e20f 114843 lastpass-cli_1.3.1.orig.tar.gz
 b76bd352742f10e40185c340c2394265e09f49e2 4788 lastpass-cli_1.3.1-1.debian.tar.xz
 328d7343cfe69e8af531c172590990204c20c048 214420 lastpass-cli-dbgsym_1.3.1-1_amd64.deb
 e9950dfc3f44a5a9bebf12b22b53bc0d97f5dfd7 8246 lastpass-cli_1.3.1-1_amd64.buildinfo
 ee21a91c680b5071a4464358c9389686c5ce0d59 88792 lastpass-cli_1.3.1-1_amd64.deb
Checksums-Sha256:
 1a42b4513bce4146cf35f7db987ea6900bf9fb0223ece829b9e54d7ad0001cf9 2011 lastpass-cli_1.3.1-1.dsc
 25dc9a0c99a10ee70b5b3991d525448c25f312cc69fa0216d7ac70c4ae384b1b 114843 lastpass-cli_1.3.1.orig.tar.gz
 f1afd0906566f0d00b690df65053b98421cc1537f6ae2661e4c60b1a780a817e 4788 lastpass-cli_1.3.1-1.debian.tar.xz
 2ea273b6b0b387500e3842f4f25d39c26fcfcc1bef63b0a6e856b0291b404ffa 214420 lastpass-cli-dbgsym_1.3.1-1_amd64.deb
 343afeb440fb6b9b5fec2a828fdb543fb982aff1a224d919c0c2b6900dd9a474 8246 lastpass-cli_1.3.1-1_amd64.buildinfo
 c288643e78288d59da1feebea4f5c849e8e2701c1ae6029e061d698eed664473 88792 lastpass-cli_1.3.1-1_amd64.deb
Files:
 4835a7b63e8e18bab560e1e274941633 2011 utils optional lastpass-cli_1.3.1-1.dsc
 ba56790f446e571a7160084a495f7043 114843 utils optional lastpass-cli_1.3.1.orig.tar.gz
 2b424d97be5492d9abb1d8a954928181 4788 utils optional lastpass-cli_1.3.1-1.debian.tar.xz
 3a2c7d7202fab29fa75318166eb62958 214420 debug optional lastpass-cli-dbgsym_1.3.1-1_amd64.deb
 f7bedd84d747bb7bb0f645dc23909596 8246 utils optional lastpass-cli_1.3.1-1_amd64.buildinfo
 f51f57e3b0041377a0f04318389d23a1 88792 utils optional lastpass-cli_1.3.1-1_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAlsXrcUACgkQHpU+J9Qx
HljkRA/9EqY2Kv9S4c/TVEywmfkY/IQT43kPoQ8otLs9ufyciWv1dfHlMkAEQRJp
x5cAkkMwnLBg2oxmdqm7p3R31DxPNLMUuodbcAhxrtpMNCvySRd9fE4d2bjUhiIz
DbknuW2fuSHh6df4PM+TXseA265Kgm1FkicKKIA9Yuv31BPyOwwLFzHkhnv0Dunr
I+6emZ3AoaL5ygM+Sy3Y7RQZlxQAX4vdoB9cZGAccexE14x97AoZ2/DeJbD6tsXQ
z44mYEGuFCgrcP31FEVRpGAq3mHks8RxzitQnFQPBsVNztAGhmdL2S2LLtkvzU5n
l+E6WBlwdLv6PeLafcyYstNloxdCl3D1kRKkkQ+ggshJTqlrqyV34QgWRKW/0/VR
c1Uuud2RwY2Tc0h4I2FkNzwNXDB+u4iGTUWpNVMgJdcjZcFNU8t3k/UQwoysi2ho
+8/6XJI5GIyLd3UFKpJehLSLm9wqc6+6HeHowRmd4nJ4/5ceoXUREdnydampBbJL
mOFhULWQ4n1gaGbxxIcduW09HldzVx6IbkRRSiCDZXag1KdtsSJKgcn3ZjaT5Dt5
oVrQx3et0Kd/kNRH6S7+xn9gRj8Wu6EDaXswr4kdXIfDGD2WD0bwT4bKPtwgpKDd
dUm3M2kKHYLe2VnS+80zsVh5IZj/i6zfyArDRacYvLCYDLdYCxc=
=00fR
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.