Debian Bug report logs - #995651
fdutils: reproducible builds: Embedded timestamps in .dvi file

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: submit@bugs.debian.org

Subject: fdutils: reproducible builds: Embedded timestamps in .dvi file

Date: Sun, 03 Oct 2021 10:04:22 -0700

[Message part 1 (text/plain, inline)]

Source: fdutils
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

The build timestamp is embedded in various .dvi files:

  https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/fdutils.html

  /usr/share/doc/fdutils/Fdutils.dvi.gz

  ··TeX·output·2021.
vs.
  ··TeX·output·2022.

  ··09.21:0514......
vs.
  ··10.24:1139......

The attached patch fixes this by setting FORCE_SOURCE_DATE=1 in
debian/rules, which texlive needs in order to respect SOURCE_DATE_EPOCH,
which is set during debian package builds to the timestamp in the latest
debian/changelog entry.

  https://reproducible-builds.org/docs/source-date-epoch/

With this patch applied, fdutils should build reproducibly on
tests.reproducible-builds.org

Thanks for maintaining fdutils!

live well,
  vagrant

[0001-debian-rules-Export-FORCE_SOURCE_DATE-1-in-order-for.patch (text/x-diff, inline)]

From 240f44a97bec6af8271560526c0ca5f629ee6a3b Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Sun, 3 Oct 2021 17:00:13 +0000
Subject: [PATCH] debian/rules: Export FORCE_SOURCE_DATE=1 in order for texlive
 to respect SOURCE_DATE_EPOCH when generating .dvi file.

https://reproducible-builds.org/docs/source-date-epoch/
---
 debian/rules | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/debian/rules b/debian/rules
index 090d7a4..bee225b 100755
--- a/debian/rules
+++ b/debian/rules
@@ -6,6 +6,9 @@ export DH_OPTIONS=-v
 
 export DEB_BUILD_MAINT_OPTIONS = hardening=+all
 
+# Ensure texlive respects SOURCE_DATE_EPOCH
+export FORCE_SOURCE_DATE=1
+
 %:
 	dh $@ --no-parallel
 
-- 
2.33.0

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 995651-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 995651-close@bugs.debian.org

Subject: Bug#995651: fixed in fdutils 5.6-3

Date: Wed, 08 Feb 2023 23:21:05 +0000

Source: fdutils
Source-Version: 5.6-3
Done: Matteo Cypriani <mcy@lm7.fr>

We believe that the bug you reported is fixed in the latest version of
fdutils, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 995651@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Matteo Cypriani <mcy@lm7.fr> (supplier of updated fdutils package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Wed, 08 Feb 2023 23:50:03 +0100
Source: fdutils
Binary: fdutils fdutils-dbgsym
Architecture: source amd64
Version: 5.6-3
Distribution: unstable
Urgency: medium
Maintainer: Matteo Cypriani <mcy@lm7.fr>
Changed-By: Matteo Cypriani <mcy@lm7.fr>
Description:
 fdutils    - Linux floppy utilities
Closes: 995651 1013690
Changes:
 fdutils (5.6-3) unstable; urgency=medium
 .
   [ Debian Janitor ]
   * Remove constraints unnecessary since buster (oldstable).
     (Closes: #1013690)
 .
   [ Vagrant Cascadian ]
   * d/rules: export FORCE_SOURCE_DATE=1 in order for texlive to respect
     SOURCE_DATE_EPOCH when generating .dvi file (reproducible builds).
     (Closes: #995651)
 .
   [ Matteo Cypriani ]
   * Bump Standards-Version to 4.6.2 (no changes needed).
   * Updated d/copyright.
   * Added d/upstream/metadata.
   * Lintian overrides:
     + Added upstream-metadata-missing-repository.
     + Fixed unconditional-use-of-dpkg-statoverride (added wildcard).
     + Renamed debian-watch-does-not-check-gpg-signature to
       debian-watch-does-not-check-openpgp-signature.
Checksums-Sha1:
 04e3c057f8cbd377ca5b2df576588ffaa0c92f80 1872 fdutils_5.6-3.dsc
 3ec9f93aada00046b2abdac195114ce831630f71 49692 fdutils_5.6-3.debian.tar.xz
 e0ac0e81e14cb223ad191414dd253d9564714e9a 219496 fdutils-dbgsym_5.6-3_amd64.deb
 ba3a185002f2c668f4d52d0a61cf167c6670dd3e 8235 fdutils_5.6-3_amd64.buildinfo
 73a163c8a2a1061de24aef347377c17395d47c7c 322224 fdutils_5.6-3_amd64.deb
Checksums-Sha256:
 2ab4e4d27efdf38fc985cceedd953c6e6253935c8a361735309f581949825add 1872 fdutils_5.6-3.dsc
 e6aff8e9f23ca3ad400a07080f49f5e0ea0b2d50dc30c272a06c78fcf912f4ec 49692 fdutils_5.6-3.debian.tar.xz
 002fd9595770c0fb4033b40979d6354aec28b134d7f687931cd2430c10e7c4c9 219496 fdutils-dbgsym_5.6-3_amd64.deb
 5ce8a8b20c484ad4b945e00a8672d860bfb07e73e76bae56cb42c22d69563d58 8235 fdutils_5.6-3_amd64.buildinfo
 a196c6b7a78fdc3fbde9b65795b5a22ffbe2b2cf9332db1b850ec72b5eb3894c 322224 fdutils_5.6-3_amd64.deb
Files:
 186a8546695184645b5da2b4fd438f14 1872 utils optional fdutils_5.6-3.dsc
 ccd13c8da8efde1d7a9aee16d7da1ddd 49692 utils optional fdutils_5.6-3.debian.tar.xz
 3e939531a9f91f3ca3540e11ca20a1af 219496 debug optional fdutils-dbgsym_5.6-3_amd64.deb
 4a91c9bec4f36135aa22929321b2e2b7 8235 utils optional fdutils_5.6-3_amd64.buildinfo
 2fb46ba6802b4cc5f3b5ffe33f3f067c 322224 utils optional fdutils_5.6-3_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEElfqmSN59CuzI3cuYTpAY4KMpEmsFAmPkKAgACgkQTpAY4KMp
EmtdYg/8DQVRcYYb65NzZH9MW3jIcjds+uoV3DLUjDXW9q3L23IdvXf39SOxwoCl
aSiZHtu2LDOo9bhebH6GVps4UBuZLeg+6z7Y2MArfd1j9YxMDBR1klS/seriYhE7
jXFZXllZMDywGCw3mrYhtRUNDTgBVvdgnWPUV3EJ7V81+K8xh/tz+kxHPKHG3L4Y
ggjEgO0rmrd/PJjlJ+Yt9jhEVy0hDqIiehvrD4avfvzuKw0AIKmYbjtWyzVm0iAI
knHyTIQB+fw5FU2iylAV7S1XUPLDY5dhzFZQqDV/xvcLhJjGA4qyfswlV+h2Cs4J
lXv3PSelVhyH5QeubOedoMf+kJcRXTcR7ciQTn1HbDgDke3nr9pCsujWZ73n2heD
C8LZrmx+/7egE59Tn7cSsDjU/ES65K1TLgVfgr7pz8H5ruqcvLgJYjYivdPgnoGX
nKMEpOnZYnnqAmVCq1DRgD4JRV2OGF1bL4ltRSEymaMlu36mWSbPkuaUVV3533am
gh9h49aMiB4rFLfp4yU9MFVS+3BKvy2DQUgcjf8LAPAOoFozC9doJUxkiAjWd/yW
bYoQ4uTQCOrIpe0ezwo2ZappeNNUhhZLd6pW0jPYXyEfDKS95zB1kmn3txjbUpLM
vMU93d7w8ijZ/SSr2mVpOwtnN5e20PWa+1Argag+ctlnK1r/yX0=
=tm21
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.