Debian Bug report logs - #973845
cmake: tar subcommand has no way to disable storing uid/gid in PKZIP format archive

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Thorsten Glaser <tg@mirbsd.de>

To: submit@bugs.debian.org

Subject: cmake: tar subcommand has no way to disable storing uid/gid in PKZIP format archive

Date: Thu, 5 Nov 2020 22:20:50 +0000 (UTC)

Package: cmake
Version: 3.18.4-1
Severity: wishlist
Tags: upstream
User: reproducible-builds@lists.alioth.debian.org
Usertags: toolchain, username
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

The musescore3 source package uses the following construct…

    COMMAND "${CMAKE_COMMAND}" -E tar cf "${PATH_OUT_ABS}" --format=zip -- ${FILES_IN}

… to create PKZIP-format archives at build time. The cmake-
builtin “tar” command has options to clamp(? set?) the mtime,
but not to prevent inclusion of the uid/gid into the archive,
producing the following diffoscope output:

··The·central-directory·extra·field·contains:					··The·central-directory·extra·field·contains:
··-·A·subfield·with·ID·0x5455·(universal·time)·and·13·data·bytes.		··-·A·subfield·with·ID·0x5455·(universal·time)·and·13·data·bytes.
····The·local·extra·field·has·UTC/GMT·modification/access/creation·times.	····The·local·extra·field·has·UTC/GMT·modification/access/creation·times.
··-·A·subfield·with·ID·0x7875·(Unix·UID/GID·(any·size))·and·11·data·bytes:	··-·A·subfield·with·ID·0x7875·(Unix·UID/GID·(any·size))·and·11·data·bytes:
····01·04·57·04·00·00·04·57·04·00·00.						····01·04·ae·08·00·00·04·ae·08·00·00.

Basically, the UID changed from 0x0457 to 0x08AE (AFAICT).

Now “zip” from info-zip has the following option:

     -X   Do not save extra file attributes (Extended Attributes
          on OS/2, uid/gid and file times on Unix).

This functionality would be useful to have here, for reproducible
builds. (We also must be able to detect it, so building with older
cmake versions doesn’t fail.) Then I can ask upstream to include
it. (Changing the build to use info-zip is not an option, as upstream
also builds on commercial OSes; extra dependencies are unwanted.)

bye,
//mirabilos
-- 
Stéphane, I actually don’t block Googlemail, they’re just too utterly
stupid to successfully deliver to me (or anyone else using Greylisting
and not whitelisting their ranges). Same for a few other providers such
as Hotmail. Some spammers (Yahoo) I do block.

Send a report that this bug log contains spam.