Package: reprotest Followup-For: Bug #1093412 X-Debbugs-Cc: ijack...@chiark.greenend.org.uk
When building reprotest-0.7.29 on debian:testing, with autopkgtests disabled and regardless of whether faketime is used, I am currently able to reliably repeat build a deb file with hash: $ DEB_BUILD_OPTIONS=nocheck dpkg-buildpackage ... $ sha256sum ../*.deb 986a53b233678df21a52ba5aa9863d5975282090c0dffbe327a19bd35d7ff3c6 Using a near-identical build process on debian:unstable, with faketime 0.9.10+2024-06-05+gba9ed5b2-0.1 installed, I am able to achieve a deterministic result _either_ by building without faketime: $ DEB_BUILD_OPTIONS=nocheck dpkg-buildpackage ... $ sha256sum ../*.deb dc46a0b73fa51630f0f6791938f63917e76fab60e57f39da39b6f6f4147d9940 ../reprotest_0.7.29_all.deb # repeatable (the hash does not appear to vary based on the faketime duration) ...or by choosing a fixed faketime duration no more than 331 hours from now. But the hash of the build output differs based on the selected duration. Choosing durations more than 331 hours from now (approx 2025-02-02; there's no particular significance to that date or corresponding Unix epoch timestamp as far as I can tell, initially...) causes the build output to become undeterministic. $ NO_FAKE_STAT=1 DEB_BUILD_OPTIONS=nocheck faketime '+331hours' dpkg-buildpackage ... $ sha256sum ../*.deb dc46a0b73fa51630f0f6791938f63917e76fab60e57f39da39b6f6f4147d9940 ../reprotest_0.7.29_all.deb # without faketime cd6356a7bd7512ac0739fdb701c7647ee109f32feba637419e1514fd7f10b4c0 ../reprotest_0.7.29_all.deb # currently repeatable at fixed +331hours I don't know what this implies yet, if anything; I'll continue experimenting within the next few hours. _______________________________________________ Reproducible-builds mailing list Reproducible-builds@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/reproducible-builds
