On 2026-09-30, Vagrant Cascadian wrote: > On 2026-09-30, Vagrant Cascadian wrote: >> On 2026-09-25, Jochen Sprickerhof wrote: >>> * Vagrant Cascadian <[email protected]> [2026-09-24 12:33]: >>>>On 2026-07-10, Jochen Sprickerhof wrote: >>>>> * Chris Lamb <[email protected]> [2021-03-16 09:19]: >>>>>>Whilst working on the Reproducible Builds effort [0] we noticed that >>>>>>cdebootstrap could not be built reproducibly. > ... >>>>in debian/rules and setting "Rules-Requires-Root: binary-targets" in >>>>debian/control, otherwise the username, groupname and user id and group >>>>id also get embedded in both the tarball: >>> >>> I don't see a need for that and I just tested the change without and >>> build is fine and autopkgtest runs without problem. As we only change a >>> tar call I don't think there is a need. >> >> Well, tests.reproducible-builds.org still shows differences in the >> various package data.tar.gz, so it will continue to be unreproducible >> there unless that part gets fixed: >> >> >> https://tests.reproducible-builds.org/debian/rb-pkg/forky/amd64/diffoscope-results/cdebootstrap.html >> >> Less important, but my test setup also tests this... :) >> >> With a closer look, it only appears to be the directories in the >> data.tar.gz, not the regular files... >> >>> In general we try to avoid R³ binary-targts as it makes reproducing much >>> harder and in case there is a need debputy should be the better option. >> >> Open to other ideas of how to fix it properly. Might try to poke at this >> a little more... > > Ok, passing "dpkg-deb --root-owner-group" in helper/Makefile.am did the trick! > > So, a complete patch that works for me: ... > I would like to perform a Non-Maintainer Upload (NMU) with this patch in > the coming weeks.
I have uploaded an NMU to DELAYED/10, debdiff attached. More granular git commits are available via dgit. live well, vagrant
diff -Nru cdebootstrap-0.7.9/debian/changelog cdebootstrap-0.7.9+nmu1/debian/changelog --- cdebootstrap-0.7.9/debian/changelog 2025-07-21 07:33:58.000000000 -0700 +++ cdebootstrap-0.7.9+nmu1/debian/changelog 2026-10-14 17:36:50.000000000 -0700 @@ -1,3 +1,18 @@ +cdebootstrap (0.7.9+nmu1) unstable; urgency=medium + + * Non-maintainer upload. + + [ Chris Lamb ] + * debian/rules: Pass argument to sort tar entries. (Closes: #985335) + + [ Vagrant Cascadian ] + * debian/rules: Pass options to tar to use numeric owner and group. + (Closes: #985335) + * helper/Makefile.am: Pass --root-owner-group tp dpkg-deb. + (Closes: #985335) + + -- Vagrant Cascadian <[email protected]> Wed, 14 Oct 2026 17:36:50 -0700 + cdebootstrap (0.7.9) unstable; urgency=medium * Test current Debian releases. (closes: #1109454) diff -Nru cdebootstrap-0.7.9/debian/rules cdebootstrap-0.7.9+nmu1/debian/rules --- cdebootstrap-0.7.9/debian/rules 2025-07-21 00:30:41.000000000 -0700 +++ cdebootstrap-0.7.9+nmu1/debian/rules 2026-10-14 17:36:50.000000000 -0700 @@ -38,7 +38,10 @@ dh_auto_install --builddir build-tar --destdir debian/tmp strip --remove-section=.comment --remove-section=.note debian/tmp/usr/bin/cdebootstrap - tar -C debian/tmp/usr/bin --mtime=@$(SOURCE_DATE_EPOCH) -cf debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar . + tar -C debian/tmp/usr/bin --sort=name \ + --owner=0 --group=0 --numeric-owner \ + --mtime=@$(SOURCE_DATE_EPOCH) \ + -cf debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar . mkdir -p debian/cdebootstrap-static/usr/lib/cdebootstrap cp debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar debian/cdebootstrap-static/usr/lib/cdebootstrap diff -Nru cdebootstrap-0.7.9/helper/Makefile.am cdebootstrap-0.7.9+nmu1/helper/Makefile.am --- cdebootstrap-0.7.9/helper/Makefile.am 2025-07-21 00:30:41.000000000 -0700 +++ cdebootstrap-0.7.9+nmu1/helper/Makefile.am 2026-10-14 17:36:50.000000000 -0700 @@ -24,7 +24,7 @@ $(MAKE) -C $(PACKAGE) package DESTDIR=$(CURDIR)/temp-$(PACKAGE) root-%: - dpkg-deb -Zgzip --build temp-$(PACKAGE) $(PACKAGE).deb + dpkg-deb -Zgzip --root-owner-group --build temp-$(PACKAGE) $(PACKAGE).deb clean-local: rm -rf $(foreach package,$(packages),temp-$(package))
signature.asc
Description: PGP signature
