On 2026-09-25, Jochen Sprickerhof wrote: > * Vagrant Cascadian <[email protected]> [2026-09-24 12:33]: >>On 2026-07-10, Jochen Sprickerhof wrote: >>> * Chris Lamb <[email protected]> [2021-03-16 09:19]: >>>>Whilst working on the Reproducible Builds effort [0] we noticed that >>>>cdebootstrap could not be built reproducibly. >>>> >>>>This is the because the embedded .tar file does not sort its entries >>>>so it inherits the (non-deterministic) filesystem ordering. >>>> >>>>Patch attached that adds --sort=name (next to --mtime=[..]) that makes >>>>the build reproducible for me locally. >>... >>>>--- a/debian/rules 2021-03-16 08:54:17.949083106 +0000 >>>>--- b/debian/rules 2021-03-16 08:58:39.291962035 +0000 >>>>@@ -38,7 +38,7 @@ >>>> >>>> dh_auto_install --builddir build-tar --destdir debian/tmp >>>> strip --remove-section=.comment --remove-section=.note >>>> debian/tmp/usr/bin/cdebootstrap >>>>- tar -C debian/tmp/usr/bin --mtime=@$(SOURCE_DATE_EPOCH) -cf >>>>debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar . >>>>+ tar -C debian/tmp/usr/bin --sort=name --mtime=@$(SOURCE_DATE_EPOCH) -cf >>>>debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar . >>>> mkdir -p debian/cdebootstrap-static/usr/lib/cdebootstrap >>>> cp debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar >>>> debian/cdebootstrap-static/usr/lib/cdebootstrap >> >>> I have just tested this and it makes the package reproducible for me. Is >>> there anything blocking the integration of this? >> >>This also requires passing "--owner=0 --group=0 --numeric-owner" to tar > > Good point. I had missed that because sbuild always uses a fixed > username nowadays so it is less important but still a good idea. > >>in debian/rules and setting "Rules-Requires-Root: binary-targets" in >>debian/control, otherwise the username, groupname and user id and group >>id also get embedded in both the tarball: > > I don't see a need for that and I just tested the change without and > build is fine and autopkgtest runs without problem. As we only change a > tar call I don't think there is a need.
Well, tests.reproducible-builds.org still shows differences in the various package data.tar.gz, so it will continue to be unreproducible there unless that part gets fixed: https://tests.reproducible-builds.org/debian/rb-pkg/forky/amd64/diffoscope-results/cdebootstrap.html Less important, but my test setup also tests this... :) With a closer look, it only appears to be the directories in the data.tar.gz, not the regular files... > In general we try to avoid R³ binary-targts as it makes reproducing much > harder and in case there is a need debputy should be the better option. Open to other ideas of how to fix it properly. Might try to poke at this a little more... live well, vagrant
signature.asc
Description: PGP signature
