Source: lirc Severity: normal Tags: patch User: [email protected] Usertags: umask timestamps X-Debbugs-Cc: [email protected]
The lirc package ships a /usr/share/lirc/lirc-VERSION.tar.gz tarball. This tarball contains timestamps produced during the build, can be affected by the umask of the build environment. https://tests.reproducible-builds.org/debian/rb-pkg/bullseye/amd64/diffoscope-results/lirc.html /usr/share/lirc/lirc-0.10.1.tar.gz -rw-r--r--···0·root···(0)·root···(0)··1667·2017-09-10·08:52:19.000000·lirc-0.10.1/README.rst vs. -rw-rw-r--···0·root···(0)·root···(0)··1667·2017-09-10·08:52:19.000000·lirc-0.10.1/README.rst I do not know enough about lirc to know if this tarball needed to be shipped in the package, or could they be shipped as files in the filesystem instead? If it is ok to remove the tarball entirely, the attached patch fixes these issues by removing the tarball from debian/rules. If that is not an appropriate way forward, I can look into how to generate the tarball deterministically. It appears to use setup.py to generate the tarball: Makefile.am- cd $(abs_builddir)/python-pkg; CFLAGS=-I$(abs_top_srcdir)/lib \ Makefile.am- LDFLAGS=-L$(abs_builddir)/lib/.libs $(PYTHON) setup.py -q sdist Thanks for maintaining lirc! live well, vagrant
From f0785b3b08c91abd7fa502e98cdd15a79fdbd4b9 Mon Sep 17 00:00:00 2001 From: Vagrant Cascadian <[email protected]> Date: Sat, 2 Jan 2021 02:59:53 +0000 Subject: [PATCH 5/5] debian/rules: Delete shipped tarball of python source code. The tarball includes timestamps and various other things that may vary between builds. https://reproducible-builds.org/docs/archives/ --- debian/rules | 3 +++ 1 file changed, 3 insertions(+) diff --git a/debian/rules b/debian/rules index beabc5e..ee55368 100755 --- a/debian/rules +++ b/debian/rules @@ -1,6 +1,7 @@ #!/usr/bin/make -f include /usr/share/dpkg/architecture.mk +include /usr/share/dpkg/pkg-info.mk export DEB_BUILD_MAINT_OPTIONS = hardening=+all export DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed @@ -74,6 +75,8 @@ endif override_dh_install: dh_install --fail-missing + # Remove python tarball + rm -f debian/lirc/usr/share/lirc/lirc-$(DEB_VERSION_UPSTREAM).tar.gz override_dh_installinit: dh_installinit --package=lirc --name=lircd -- 2.30.0
signature.asc
Description: PGP signature
