Debian Bug report logs - #995647
cfi: reproducible builds: Embedded timestamps in .dvi file

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: submit@bugs.debian.org

Subject: cfi: reproducible builds: Embedded timestamps in .dvi file

Date: Sun, 03 Oct 2021 09:39:41 -0700

[Message part 1 (text/plain, inline)]

Source: cfi
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

The build timestamp is embedded in various .dvi files:

  https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/cfi.html

  ./usr/share/doc/cfi-sv/cfi.dvi.gz

  ··TeX·output·2022.
vs.
  ··TeX·output·2021.
00000020:·3039·2e32·373a·3139·3439·8b00·0000·0100

  ··09.27:1949......
vs.
  ··08.26:1527......

The attached patch fixes this by setting FORCE_SOURCE_DATE=1 in
debian/rules, which texlive needs in order to respect SOURCE_DATE_EPOCH,
which is set during debian package builds to the timestamp in the latest
debian/changelog entry.

  https://reproducible-builds.org/docs/source-date-epoch/

With this patch applied, cfi should build reproducibly on
tests.reproducible-builds.org

Thanks for maintaining cfi!

live well,
  vagrant

[0001-debian-rules-Export-FORCE_SOURCE_DATE-1-in-order-for.patch (text/x-diff, inline)]

From 476f5bb1a67ae26eb6f5658c5cb53ea7a112e196 Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Sun, 3 Oct 2021 16:33:02 +0000
Subject: [PATCH] debian/rules: Export FORCE_SOURCE_DATE=1 in order for texlive
 to respect SOURCE_DATE_EPOCH when generating .dvi file.

https://reproducible-builds.org/docs/source-date-epoch/
---
 debian/rules | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/debian/rules b/debian/rules
index bacf9a0..0cc7651 100755
--- a/debian/rules
+++ b/debian/rules
@@ -3,6 +3,9 @@
 # Uncomment this to turn on verbose mode.
 #export DH_VERBOSE=1
 
+# Ensure texlive respects SOURCE_DATE_EPOCH
+export FORCE_SOURCE_DATE=1
+
 build: build-arch build-indep
 build-arch: build-stamp
 build-indep: build-stamp
-- 
2.33.0

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 995647@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: 995647@bugs.debian.org

Subject: Re: cfi: reproducible builds: Embedded timestamps in .dvi file

Date: Thu, 29 Dec 2022 13:12:39 -0800

[Message part 1 (text/plain, inline)]

Control: tags 995647 pending

On 2021-10-03, Vagrant Cascadian wrote:
> The build timestamp is embedded in various .dvi files:
>
>   https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/cfi.html
>
>   ./usr/share/doc/cfi-sv/cfi.dvi.gz
>
>   ··TeX·output·2022.
> vs.
>   ··TeX·output·2021.
> 00000020:·3039·2e32·373a·3139·3439·8b00·0000·0100
>
>   ··09.27:1949......
> vs.
>   ··08.26:1527......
>
> The attached patch fixes this by setting FORCE_SOURCE_DATE=1 in
> debian/rules, which texlive needs in order to respect SOURCE_DATE_EPOCH,

Uploaded an NMU fixing this issue to DELAYED/10:

diff -Nru cfi-3.0/debian/changelog cfi-3.0/debian/changelog
--- cfi-3.0/debian/changelog	2021-01-05 07:09:27.000000000 -0800
+++ cfi-3.0/debian/changelog	2022-12-29 12:47:39.000000000 -0800
@@ -1,3 +1,11 @@
+cfi (3.0-10.2) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * debian/rules: Export FORCE_SOURCE_DATE=1 in order for texlive to
+    respect SOURCE_DATE_EPOCH when generating .dvi file. (Closes: #995647)
+
+ -- Vagrant Cascadian <vagrant@reproducible-builds.org>  Thu, 29 Dec 2022 12:47:39 -0800
+
 cfi (3.0-10.1) unstable; urgency=medium
 
   * Non maintainer upload by the Reproducible Builds team.
diff -Nru cfi-3.0/debian/rules cfi-3.0/debian/rules
--- cfi-3.0/debian/rules	2012-11-10 12:28:46.000000000 -0800
+++ cfi-3.0/debian/rules	2022-12-29 12:47:39.000000000 -0800
@@ -3,6 +3,9 @@
 # Uncomment this to turn on verbose mode.
 #export DH_VERBOSE=1
 
+# Ensure texlive respects SOURCE_DATE_EPOCH
+export FORCE_SOURCE_DATE=1
+
 build: build-arch build-indep
 build-arch: build-stamp
 build-indep: build-stamp


live well,
  vagrant

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 995647-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 995647-close@bugs.debian.org

Subject: Bug#995647: fixed in cfi 3.0-10.2

Date: Sun, 08 Jan 2023 21:50:54 +0000

Source: cfi
Source-Version: 3.0-10.2
Done: Vagrant Cascadian <vagrant@reproducible-builds.org>

We believe that the bug you reported is fixed in the latest version of
cfi, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 995647@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Vagrant Cascadian <vagrant@reproducible-builds.org> (supplier of updated cfi package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 29 Dec 2022 12:47:39 -0800
Source: cfi
Architecture: source
Version: 3.0-10.2
Distribution: unstable
Urgency: medium
Maintainer: Barbara "Jana" Wisniowska <debian@janapirat.de>
Changed-By: Vagrant Cascadian <vagrant@reproducible-builds.org>
Closes: 995647
Changes:
 cfi (3.0-10.2) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * debian/rules: Export FORCE_SOURCE_DATE=1 in order for texlive to
     respect SOURCE_DATE_EPOCH when generating .dvi file. (Closes: #995647)
Checksums-Sha1:
 938e437df2683d06069926b35c4f59c1d214db7a 1283 cfi_3.0-10.2.dsc
 1296c96f4447e753338615da42b08ab24519e4a0 10120 cfi_3.0-10.2.debian.tar.xz
Checksums-Sha256:
 4379398ed8c05a45ff81c3380bc9a38ace5dc3e547ac12e4e5a5ce5fc4eba510 1283 cfi_3.0-10.2.dsc
 0ccd1c16b8ba17edb33fd87cd3be9196e16538b4c69fbe4c612cb50aeed5d814 10120 cfi_3.0-10.2.debian.tar.xz
Files:
 13c2ee90af94a2bfb2cfe1e4378176ea 1283 doc optional cfi_3.0-10.2.dsc
 036e2edfab3fdefecc92019cb8340182 10120 doc optional cfi_3.0-10.2.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iJYEARYKAD4WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCY63/IyAcdmFncmFudEBy
ZXByb2R1Y2libGUtYnVpbGRzLm9yZwAKCRDcUY/If5cWqgvnAQCyX+F6o0JK/0h1
xhYu77TsBHyoAYQ041lXf0nyx5PFSAD/cgpEnV+yVNxn6s3mqyb/MTozfut4KIZ1
svcOlJvNZgo=
=Vjc+
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.