Debian Bug report logs - #977412
xastir: reproducible builds: Binaries contain embedded paths from usrmerge systems

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: submit@bugs.debian.org

Subject: xastir: reproducible builds: Binaries contain embedded paths from usrmerge systems

Date: Mon, 14 Dec 2020 13:22:33 -0800

[Message part 1 (text/plain, inline)]

Source: xastir
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: usrmerge
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

Several binaries shipped with xastir include embedded paths to the "sed"
and "mv" commands:

  https://tests.reproducible-builds.org/debian/rb-pkg/bullseye/i386/diffoscope-results/xastir.html

  4074 	/bin/sed
  4074 	/usr/bin/sed

The attached patches fix this by adding support for the SED_PATH and
MV_PATH variables to configure.ac, and passing those variables to
configure in debian/rules.


Thanks for maintaining xastir!


live well,
  vagrant

[0001-debian-patches-Support-passing-SED_PATH-And-MV_PATH-.patch (text/x-diff, inline)]

From aefe065298f0c141a1d8fa672173c6ff168c1c38 Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Mon, 14 Dec 2020 21:03:31 +0000
Subject: [PATCH 1/2] debian/patches: Support passing SED_PATH And MV_PATH in
 configure.ac.

It is needed to be able to pass these variables to configure in order
for builds to be reproducible when package is built on a usrmerge
system vs. a non-usrmerge system.

https://tests.reproducible-builds.org/debian/issues/unstable/paths_vary_due_to_usrmerge_issue.html
---
 ...-SED_PATH-and-MV_PATH-to-be-able-to-.patch | 35 +++++++++++++++++++
 debian/patches/series                         |  1 +
 2 files changed, 36 insertions(+)
 create mode 100644 debian/patches/0001-configure.ac-Use-SED_PATH-and-MV_PATH-to-be-able-to-.patch

diff --git a/debian/patches/0001-configure.ac-Use-SED_PATH-and-MV_PATH-to-be-able-to-.patch b/debian/patches/0001-configure.ac-Use-SED_PATH-and-MV_PATH-to-be-able-to-.patch
new file mode 100644
index 0000000..519e5f9
--- /dev/null
+++ b/debian/patches/0001-configure.ac-Use-SED_PATH-and-MV_PATH-to-be-able-to-.patch
@@ -0,0 +1,35 @@
+From d1fac87519eb9b97fa503d0a3ac98a7662400d72 Mon Sep 17 00:00:00 2001
+From: Vagrant Cascadian <vagrant@reproducible-builds.org>
+Date: Mon, 14 Dec 2020 03:20:51 +0000
+Subject: [PATCH] configure.ac: Use SED_PATH and MV_PATH to be able to specify
+ path to sed and mv.
+
+---
+ configure.ac | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index d0e33fd..52e5226 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -159,7 +159,7 @@ AC_CHECK_LIB([Xm], [XmTextFindString])
+ 
+ 
+ use_sed=no
+-AC_PATH_PROG(sed, [sed --version], no, $BINPATH)
++AC_PATH_PROG(SED_PATH, [sed --version], no, $BINPATH)
+ if test "$sed" != "no"; then
+   AC_DEFINE_UNQUOTED(HAVE_SED, 1, [Define if you have sed]) 
+   AC_DEFINE_UNQUOTED(SED_PATH, "${sed}", [Path to sed]) 
+@@ -169,7 +169,7 @@ fi
+ 
+ 
+ use_mv=no
+-AC_PATH_PROG(mv, [mv --version], no, $BINPATH)
++AC_PATH_PROG(MV_PATH, [mv --version], no, $BINPATH)
+ if test "$mv" != "no"; then
+   AC_DEFINE_UNQUOTED(HAVE_MV, 1, [Define if you have mv]) 
+   AC_DEFINE_UNQUOTED(MV_PATH, "${mv}", [Path to mv]) 
+-- 
+2.20.1
+
diff --git a/debian/patches/series b/debian/patches/series
index 037ff16..bfe2657 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -3,3 +3,4 @@ geotiff_directory.patch
 link.patch
 OSM_config.patch
 simple_db.patch
+0001-configure.ac-Use-SED_PATH-and-MV_PATH-to-be-able-to-.patch
-- 
2.20.1

[0002-debian-rules-Add-dh_auto_configure-override-to-pass-.patch (text/x-diff, inline)]

From cdc4738e3378848128ea112334e97025daa6bc10 Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Mon, 14 Dec 2020 02:29:26 +0000
Subject: [PATCH 2/2] debian/rules: Add dh_auto_configure override to pass
 SED_PATH and MV_PATH.

The path to "sed" and "mv" may vary as either /bin/CMD or /usr/bin/CMD
if the system is configured as a usrmerge system. Use /bin/CMD for the
most compatible location.

https://tests.reproducible-builds.org/debian/issues/unstable/paths_vary_due_to_usrmerge_issue.html
---
 debian/rules | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/debian/rules b/debian/rules
index 8ad983b..7d0a07b 100755
--- a/debian/rules
+++ b/debian/rules
@@ -7,3 +7,6 @@ export DEB_BUILD_MAINT_OPTIONS=hardening=+all
 
 override_dh_auto_installchangelogs:
 	dh_installchangelogs ChangeLog
+
+override_dh_auto_configure:
+	dh_auto_configure -- SED_PATH=/bin/sed MV_PATH=/bin/mv
-- 
2.20.1

[signature.asc (application/pgp-signature, inline)]

Message #10 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: submit@bugs.debian.org

Subject: Bug#977412: klayout: reproducible builds: Binaries contain build timestamps

Date: Mon, 14 Dec 2020 14:16:15 -0800

[Message part 1 (text/plain, inline)]

Source: klayout
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

Several binaries shipped with klayout include the build time:

  https://tests.reproducible-builds.org/debian/rb-pkg/bullseye/amd64/diffoscope-results/klayout.html

  ./usr/lib/klayout/klayout
  124 	2021-12-18
  124 	2020-11-16


The attached patch fixes this by adjusting the call to date in
version.sh to use the SOURCE_DATE_EPOCH environment variable.

This patch does not resolve all reproducibility issues (e.g. build
paths), but combined with a patch soon to follow, should make klayout
reproducible when it lands in bullseye (where build paths are not
tested).


Thanks for maintaining klayout!


live well,
  vagrant

[0001-Set-KLAYOUT_VERSION_DATE-in-version.sh-using-value-f.patch (text/x-diff, inline)]

From 7bf8f643614cf1398e7ef7108d3ba47200d8300d Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Mon, 14 Dec 2020 19:56:24 +0000
Subject: [PATCH 1/2] Set KLAYOUT_VERSION_DATE in version.sh using value from
 SOURCE_DATE_EPOCH.

  https://reproducible-builds.org/docs/source-date-epoch/

This patch requires GNU date extensions, and may require adjustments
for portability with other date implementations.
---
 version.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version.sh b/version.sh
index 7065aa1..03192ba 100644
--- a/version.sh
+++ b/version.sh
@@ -8,7 +8,7 @@ KLAYOUT_VERSION="0.26.2"
 KLAYOUT_PYPI_VERSION="0.26.2"
 
 # The build date
-KLAYOUT_VERSION_DATE=$(date "+%Y-%m-%d")
+KLAYOUT_VERSION_DATE=$(LC_ALL=C date --utc --date=@${SOURCE_DATE_EPOCH} "+%Y-%m-%d")
 
 # The short SHA hash of the commit
 KLAYOUT_VERSION_REV=$(git rev-parse --short HEAD 2>/dev/null)
-- 
2.29.2

[signature.asc (application/pgp-signature, inline)]

Message #13 received at 977412-submitter@bugs.debian.org (full text, mbox, reply):

From: Tony Mancill <noreply@salsa.debian.org>

To: 977412-submitter@bugs.debian.org

Subject: Bug#977412 marked as pending in xastir

Date: Tue, 15 Dec 2020 05:55:32 +0000

Control: tag -1 pending

Hello,

Bug #977412 in xastir reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian-hamradio-team/xastir/-/commit/dac9b9731bdaed178c263152b5dc2a02e1f60684

------------------------------------------------------------------------
Add patch for embedded paths in binaries for reproducible builds

Thank you to Vagrant Cascadian for the patch.  (Closes: #977412)
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/977412

Message #20 received at 977412@bugs.debian.org (full text, mbox, reply):

From: tony mancill <tmancill@debian.org>

To: Vagrant Cascadian <vagrant@reproducible-builds.org>, 977412@bugs.debian.org

Subject: Re: Bug#977412: xastir: reproducible builds: Binaries contain embedded paths from usrmerge systems

Date: Mon, 14 Dec 2020 21:58:41 -0800

[Message part 1 (text/plain, inline)]

Hi Vagrant!

On Mon, Dec 14, 2020 at 01:22:33PM -0800, Vagrant Cascadian wrote:
> Source: xastir
> Severity: normal
> Tags: patch
> User: reproducible-builds@lists.alioth.debian.org
> Usertags: usrmerge
> X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org
> 
> Several binaries shipped with xastir include embedded paths to the "sed"
> and "mv" commands:

Thank you for the bug report and the patch!  I have applied it and
uploaded.

I hope all is well - cheers,
tony

[signature.asc (application/pgp-signature, inline)]

Message #25 received at 977412-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 977412-close@bugs.debian.org

Subject: Bug#977412: fixed in xastir 2.1.6-3

Date: Tue, 15 Dec 2020 06:18:50 +0000

Source: xastir
Source-Version: 2.1.6-3
Done: tony mancill <tmancill@debian.org>

We believe that the bug you reported is fixed in the latest version of
xastir, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 977412@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
tony mancill <tmancill@debian.org> (supplier of updated xastir package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 14 Dec 2020 21:29:56 -0800
Source: xastir
Architecture: source
Version: 2.1.6-3
Distribution: unstable
Urgency: medium
Maintainer: Debian Hamradio Maintainers <debian-hams@lists.debian.org>
Changed-By: tony mancill <tmancill@debian.org>
Closes: 977412
Changes:
 xastir (2.1.6-3) unstable; urgency=medium
 .
   * Team upload.
   * Add patch for embedded paths in binaries for reproducible builds.
     Thank you to Vagrant Cascadian for the patch.  (Closes: #977412)
   * Bump Standards-Version to 4.5.1
Checksums-Sha1:
 80c2c169636778bb4ea5d6de364353aef93bdb2f 2330 xastir_2.1.6-3.dsc
 014a82a4c8d5356f142817ca99c94489192ae4ef 21132 xastir_2.1.6-3.debian.tar.xz
 6f3eec32835f8c9e4c3b827e548aa49f24acfb3a 10863 xastir_2.1.6-3_amd64.buildinfo
Checksums-Sha256:
 1e6b54badf9ac258616aa65a9eb574e4edeefdcdd3ddc699b42eb6b40ea40062 2330 xastir_2.1.6-3.dsc
 b585dcaa159f748c98f3ff177d1bece597cfa766e142101ff09ced7f12b7dc3a 21132 xastir_2.1.6-3.debian.tar.xz
 d176835269e377f20a9f831ca08fd308d768f3718e64b2b7cfd94ace9170879c 10863 xastir_2.1.6-3_amd64.buildinfo
Files:
 ec893df02e5dbf0cb7c3babba8c8fc7a 2330 hamradio optional xastir_2.1.6-3.dsc
 ce411cea8ffbd6fe531cc3583da341c9 21132 hamradio optional xastir_2.1.6-3.debian.tar.xz
 9739485d755cd627a1437c30d81e6030 10863 hamradio optional xastir_2.1.6-3_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJIBAEBCgAyFiEE5Qr9Va3SequXFjqLIdIFiZdLPpYFAl/YT7QUHHRtYW5jaWxs
QGRlYmlhbi5vcmcACgkQIdIFiZdLPpZwnBAAgh+Sft/Og3bf6hw/exs/e1gqGkEx
e70nMMy20s+SjPsKRnTqUu0aDb207np6t9YrfPiHnA/zg0L5DWXcBF+MrgJjMwwR
VdVKBqZYaiIn2yOlCknbu+hr6imkZscNFPVghduw0QP+kGGGv83p5tCust/S85WQ
M+fzahG+HqK9G7e32pq0lyVHixW96/p5WHdSxrbROLf3r+Zh/XBXCkzNOSsH2+u+
y+5fTkwR/Ta2sPNJAPgdzfFEKLsso0ZdDvHbgASkC5p3LCzTXXz0vEwVGKSbIxf3
giR6/l6BH4vONxta7BJMXTjOp/XfoDj4HV80b1C2yoRxxWhNwpHtlA1cxcL8KBJv
SXNOdwm6JDPdXEFJ9qHzJCxKPIi9q/3q+D5iSggvNvwGvzJYCO8wnArW8hDcJy30
HbqbprJ/pQxH1sfwYPFUPo5mPCqOkIcBNJw0bKGPu2W2Ma20zW5SKXxVzyWrbwlF
ksawAincXF1H/nINYzxjUfoKTq5q5ZaLmoH+xbQzPFVg1AnqaCWvif+L4Gk3SWOi
fI2zxgHuVFqQbXl9pf7vWvR9mby7LLk8iYnzKkOyw2JiKX0NFYtNlpuLc4ofrJfI
5KeoNhAvH9P+HY8ijm29YPTx9evNWIYrby+w1pwNKF7bA5gnqwlH/LJ88SQs6GZ9
Rq0GF56oDhL+T+A=
=PBnV
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.