Debian Bug report logs - #891050
gap-autpgrp: please make the build reproducible

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: submit@bugs.debian.org

Subject: gap-autpgrp: please make the build reproducible

Date: Wed, 21 Feb 2018 22:34:26 +0000

[Message part 1 (text/plain, inline)]

Source: gap-autpgrp
Version: 1.5-2
Severity: wishlist
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

Hi,

Whilst working on the Reproducible Builds effort [0], we noticed
that gap-autpgrp could not be built reproducibly:

│ │ │ ├── ./usr/share/gap/pkg/AutPGrp/doc/manual.pdf
│ │ │ │ ├── pdftotext {} -
│ │ │ │ │ @@ -2,15 +2,15 @@
│ │ │ │ │  —
│ │ │ │ │  A GAP4 Package
│ │ │ │ │  
│ │ │ │ │  by
│ │ │ │ │  
│ │ │ │ │  Bettina Eick and Eamonn O’Brien
│ │ │ │ │  
│ │ │ │ │ -March 2019
│ │ │ │ │ +February 2018

Patch attached.

 [0] https://reproducible-builds.org/


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

[gap-autpgrp.diff.txt (text/plain, attachment)]

Message #10 received at 891050@bugs.debian.org (full text, mbox, reply):

From: Bill Allombert <ballombe@debian.org>

To: Chris Lamb <lamby@debian.org>, 891050@bugs.debian.org

Subject: Re: Bug#891050: gap-autpgrp: please make the build reproducible

Date: Wed, 21 Feb 2018 23:50:31 +0100

On Wed, Feb 21, 2018 at 10:34:26PM +0000, Chris Lamb wrote:
> Source: gap-autpgrp
> Version: 1.5-2
> Severity: wishlist
> Tags: patch
> User: reproducible-builds@lists.alioth.debian.org
> Usertags: timestamps
> X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org
> 
> Hi,
> 
> Whilst working on the Reproducible Builds effort [0], we noticed
> that gap-autpgrp could not be built reproducibly:
> 
>  [0] https://reproducible-builds.org/

Hello Chris,
your patch causes the manual to be different from upstream. This is not
the goal of reproducible builds.

If you want to help with GAP, tell me why gap-gapdoc is not reproducible.

Cheers,
-- 
Bill. <ballombe@debian.org>

Imagine a large red swirl here.

Message #15 received at 891050@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: Bill Allombert <ballombe@debian.org>, 891050@bugs.debian.org

Subject: Re: Bug#891050: gap-autpgrp: please make the build reproducible

Date: Wed, 21 Feb 2018 22:52:44 +0000

Hi Bill,
 
> If you want to help with GAP, tell me why gap-gapdoc is not reproducible.

I'm not sure I can tell you anything more beyond what was in my original
report (ie. date variation due to the use of \Month and \Year).  :)

(I can 100% understand not wanting to diverge from upstream and would
certainly understand if you didn't want to take this patch before
upstream do.)


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #20 received at 891050@bugs.debian.org (full text, mbox, reply):

From: Bill Allombert <ballombe@debian.org>

To: Chris Lamb <lamby@debian.org>

Cc: Bill Allombert <ballombe@debian.org>, 891050@bugs.debian.org

Subject: Re: Bug#891050: gap-autpgrp: please make the build reproducible

Date: Thu, 22 Feb 2018 00:41:36 +0100

On Wed, Feb 21, 2018 at 10:52:44PM +0000, Chris Lamb wrote:
> Hi Bill,
>  
> > If you want to help with GAP, tell me why gap-gapdoc is not reproducible.
> 
> I'm not sure I can tell you anything more beyond what was in my original
> report (ie. date variation due to the use of \Month and \Year).  :)

I really mean gap-gapdoc, not this package.

> (I can 100% understand not wanting to diverge from upstream and would
> certainly understand if you didn't want to take this patch before
> upstream do.)

Upstream will never take it. This is not the right way to fix this bug
and you know it.

I find it a waste of time to receive such patch. It does not include any
information not available from reproducible-builds.org and suggest an
incorrect course of action (instead of using FORCE_SOURCE_DATE,
SOURCE_DATE_EPOCH etc.).

I know you know how to do better!

The whole reproducible builds is anxiogen because there are no reliable
tool to check a package is reproducible according to policy before
uploading it to the archive. reproducible-builds.org is not a suitable
substitute in many aspect.

This is sad because this is an important project. But it is not worth
the stress each time one upload a package.

Cheers,
-- 
Bill. <ballombe@debian.org>

Imagine a large red swirl here.

Message #25 received at 891050@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: Bill Allombert <ballombe@debian.org>

Cc: 891050@bugs.debian.org

Subject: Re: Bug#891050: gap-autpgrp: please make the build reproducible

Date: Thu, 22 Feb 2018 08:51:05 +0000

Dear Bill,

> Upstream will never take it. This is not the right way to fix this bug
> and you know it.

I'm afraid I was a little disappointed to read your response. 

It is entirely feasible that upstream would agree with the sentiment
that such timestamps are not useful (or even misleading) and thus
should be removed. I have convinced countless developers in the past
using this or similar arguments.

Furthermore, I did not enjoy being told "I know you know how to do
better" or being informed the patch is "a waste of time". Whatever
the merits of those statements, I could not help but interpret your
tone as needlessly hectoring and, at best, unproductive. As a project,
we should — and can — do better.

> I really mean gap-gapdoc, not this package.
[…] 
> The whole reproducible builds is anxiogen because there are no reliable
> tool to check a package is reproducible

(These are topics/questions outside the scope of this bug report; I fear
we would be doing them a disservice by attempting to cover them here.)


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #30 received at 891050@bugs.debian.org (full text, mbox, reply):

From: Bill Allombert <ballombe@debian.org>

To: Chris Lamb <lamby@debian.org>, 891050@bugs.debian.org

Subject: Re: Bug#891050: gap-autpgrp: please make the build reproducible

Date: Fri, 23 Feb 2018 01:31:50 +0100

On Thu, Feb 22, 2018 at 08:51:05AM +0000, Chris Lamb wrote:
> Dear Bill,
> 
> > Upstream will never take it. This is not the right way to fix this bug
> > and you know it.
> 
> I'm afraid I was a little disappointed to read your response. 

Sorry, but I was also a little disappointed to see such patch
coming from an experienced Debian developer.

TeX-based build systems should be fixed to use SOURCE_DATE_EPOCH etc. to
generate reproducible timestamp rather than TeX documents to be altered to
avoid timestamps. Indeed reproducible builds has the potential to make
timestamp much more accurate and useful, so it would be a waste to remove
them. Avoiding timestamps is also unsustainable in the long run.

We should favor the long term solution over the quick fix.

In the event you did not actually intend the patch to be applied, then
sorry for the confusion.

> It is entirely feasible that upstream would agree with the sentiment
> that such timestamps are not useful (or even misleading) and thus
> should be removed. I have convinced countless developers in the past
> using this or similar arguments.

Alas, the upstream of this package does not even provide a Makefile to
build the documentation. Instead the PDF file is included in the
tarball. So as far as they are concerned the timestamp are always correct
and the user has no business rebuilding the documentation.

But what is magic with SOURCE_DATE_EPOCH and other improvements from the
reproducible build project is that we can arrange for the build system
to generate the exact same timestamps than in the upstream tarball,
which is much better than removing them.

Cheers,
-- 
Bill. <ballombe@debian.org>

Imagine a large red swirl here. 

Message #35 received at 891050-close@bugs.debian.org (full text, mbox, reply):

From: Bill Allombert <ballombe@debian.org>

To: 891050-close@bugs.debian.org

Subject: Bug#891050: fixed in gap-autpgrp 1.8-1

Date: Sat, 24 Feb 2018 17:05:19 +0000

Source: gap-autpgrp
Source-Version: 1.8-1

We believe that the bug you reported is fixed in the latest version of
gap-autpgrp, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 891050@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bill Allombert <ballombe@debian.org> (supplier of updated gap-autpgrp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 23 Feb 2018 15:51:17 +0100
Source: gap-autpgrp
Binary: gap-autpgrp
Architecture: source all
Version: 1.8-1
Distribution: unstable
Urgency: medium
Maintainer: Bill Allombert <ballombe@debian.org>
Changed-By: Bill Allombert <ballombe@debian.org>
Description:
 gap-autpgrp - GAP AutPGrp - Computing the Automorphism Group of a p-Group
Closes: 891050
Changes:
 gap-autpgrp (1.8-1) unstable; urgency=medium
 .
   * New upstream release
   * patch doc-makefile:
     - install HTML doc correctly.
     - set manual date to 25/11/2016
   * debian/rules:
     - use FORCE_SOURCE_DATE. Closes: #891050.
   * debian/copyright, debian/watch:
     - update URL from ftp to https.
   * doc/Makefile: fix HTML installation
   * debian/control:
     - Move to debhelper v9
     - Bump Standards-Version to 4.1.3.
Checksums-Sha1:
 6061b1c1c48863bdedc790ae52823c69c2f2b18a 1806 gap-autpgrp_1.8-1.dsc
 48d16b96f8ab52c6dd5d9ac0e7da7b51a21b1d88 166417 gap-autpgrp_1.8.orig.tar.bz2
 8421ff7114d31772d29a4e7e8abd372024f16bf3 5144 gap-autpgrp_1.8-1.debian.tar.xz
 0a85f27eb5f59d4cdfef16645ae64273c010c7ef 178712 gap-autpgrp_1.8-1_all.deb
 df5a7fd868008db58efc428f58dfb9f54f2e3888 8065 gap-autpgrp_1.8-1_amd64.buildinfo
Checksums-Sha256:
 2d5de3d05896cb195ee4e62cc301d2a8eb681689752759d5d437f813b52702ea 1806 gap-autpgrp_1.8-1.dsc
 d29184cab9277675833aebf03df9de71221f658ae06eac90d8eee7269e2c1372 166417 gap-autpgrp_1.8.orig.tar.bz2
 aa3f319361a4c148eb2ca62b19f449318150da086d43dfbe8cb77e5f85182041 5144 gap-autpgrp_1.8-1.debian.tar.xz
 3d7cbc7007dea3458e7701fe20c1f0ce52b5bee479faa8f182ef86a1bb6e7acc 178712 gap-autpgrp_1.8-1_all.deb
 e360ea796a765ac539f6cb550f9b37b9c72f56ba912a729043efff9adb7331f0 8065 gap-autpgrp_1.8-1_amd64.buildinfo
Files:
 12490512ff3330ac1079d4c970b3a4c4 1806 math optional gap-autpgrp_1.8-1.dsc
 8ca570220d0e40dd6bb055a5169d7bfe 166417 math optional gap-autpgrp_1.8.orig.tar.bz2
 159c32d47cfa041b34bccb82916d3b41 5144 math optional gap-autpgrp_1.8-1.debian.tar.xz
 74a11b42e57c5018ef4ae5b280919c9d 178712 math optional gap-autpgrp_1.8-1_all.deb
 115ef36eb298831d56d08e892f87d05a 8065 math optional gap-autpgrp_1.8-1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEQgKOpASi6dgKxFMUjw58K0Ui44cFAlqRkaIACgkQjw58K0Ui
44fYBQ/9FappbWDvYL8w7HXoGAT8MIe4ZmcxPqYmUer7FKv3xFckce1GNXfLFfuM
f5ZQivnybNyEEgfuPgj4SXsonALHzI5fSsGMepZoAnNYvlQqXZcNZQxMMzIu1phP
1TuHTacA0DwMCWC156xLPF2XluhOIddh19//41J2znzF9H3xoqrhZh1COjwl76pp
w8gDFZWQCQ05o/QTedkPXJXH7mhommL4lixG9CJmUexpD6lf0zS4Q69L3omjx0Kw
oJ5NmwVusy+am013kLiw94QVb/BncgbBN7uy7FH4D/zH9s8pLsw3QxhHORK4cts3
jR0H6k6F6oqb7PebBV1gCO8Eusw4hRrchbMl0r38TWPbp1z8FSv+8CavZvEYj8zg
VH1W/uQSlqw9xRDxrYtzCrHh9s2c/VDXzupoJ301P7IXKy2myMz3Zus635Q6wDdh
xoiNfEFqgHw1xyj8zXMK23wKq53N8niazR3qwWRKemV+cBWQrB9jZo9oGoquINEP
Zo3YR6gonJWD0ySdJZEH/FmGUxsCrxeFdwmXEQuxMxyxBzD5it4jtlyKRLOcPXAl
TJgD1/j337fLbs0bNszkbOgus1q7bEa4vIoCJNSkA7FWgAIfV7CFLsxFqqBTQHAJ
3Rm1LQToBNJ6wplzePWootrIaV9fUWDkUADXJEOJNIPwDjSVYPo=
=K6Xr
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.