Debian Bug report logs - #979024
lirc: reproducible builds: ships tarball of python sources

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: submit@bugs.debian.org

Subject: lirc: reproducible builds: ships tarball of python sources

Date: Fri, 01 Jan 2021 19:39:25 -0800

[Message part 1 (text/plain, inline)]

Source: lirc
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: umask timestamps
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

The lirc package ships a /usr/share/lirc/lirc-VERSION.tar.gz tarball.

This tarball contains timestamps produced during the build, can be
affected by the umask of the build environment.

  https://tests.reproducible-builds.org/debian/rb-pkg/bullseye/amd64/diffoscope-results/lirc.html

  /usr/share/lirc/lirc-0.10.1.tar.gz

  -rw-r--r--···0·root···(0)·root···(0)··1667·2017-09-10·08:52:19.000000·lirc-0.10.1/README.rst
  vs.
  -rw-rw-r--···0·root···(0)·root···(0)··1667·2017-09-10·08:52:19.000000·lirc-0.10.1/README.rst


I do not know enough about lirc to know if this tarball needed to be
shipped in the package, or could they be shipped as files in the
filesystem instead?


If it is ok to remove the tarball entirely, the attached patch fixes
these issues by removing the tarball from debian/rules.


If that is not an appropriate way forward, I can look into how to
generate the tarball deterministically. It appears to use setup.py to
generate the tarball:

  Makefile.am-    cd $(abs_builddir)/python-pkg; CFLAGS=-I$(abs_top_srcdir)/lib \
  Makefile.am-        LDFLAGS=-L$(abs_builddir)/lib/.libs $(PYTHON) setup.py -q sdist


Thanks for maintaining lirc!


live well,
  vagrant

[0005-debian-rules-Delete-shipped-tarball-of-python-source.patch (text/x-diff, inline)]

From f0785b3b08c91abd7fa502e98cdd15a79fdbd4b9 Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Sat, 2 Jan 2021 02:59:53 +0000
Subject: [PATCH 5/5] debian/rules: Delete shipped tarball of python source
 code.

The tarball includes timestamps and various other things that may vary
between builds.

https://reproducible-builds.org/docs/archives/
---
 debian/rules | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/debian/rules b/debian/rules
index beabc5e..ee55368 100755
--- a/debian/rules
+++ b/debian/rules
@@ -1,6 +1,7 @@
 #!/usr/bin/make -f
 
 include /usr/share/dpkg/architecture.mk
+include /usr/share/dpkg/pkg-info.mk
 
 export DEB_BUILD_MAINT_OPTIONS      = hardening=+all
 export DEB_LDFLAGS_MAINT_APPEND     = -Wl,--as-needed
@@ -74,6 +75,8 @@ endif
 
 override_dh_install:
 	dh_install --fail-missing
+	# Remove python tarball
+	rm -f debian/lirc/usr/share/lirc/lirc-$(DEB_VERSION_UPSTREAM).tar.gz
 
 override_dh_installinit:
 	dh_installinit --package=lirc --name=lircd
-- 
2.30.0

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.