1017073">

Debian Bug report logs - #1017073
python-suntime: reproducible builds: Timestamps recorded for all packaged files

version graph

Package: src:python-suntime; Maintainer for src:python-suntime is Debian Python Team <team+python@tracker.debian.org>;

Reported by: Vagrant Cascadian <vagrant@reproducible-builds.org>

Date: Sat, 13 Aug 2022 02:45:02 UTC

Severity: normal

Tags: patch

Fixed in version python-suntime/1.2.5-5

Done: James Addison <jay@jp-hosting.net>

Bug is archived. No further changes may be made.

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, reproducible-bugs@lists.alioth.debian.org, Adam Cecile <acecile@le-vert.net>:
Bug#1017073; Package src:python-suntime. (Sat, 13 Aug 2022 02:45:04 GMT) (full text, mbox, link).


Acknowledgement sent to Vagrant Cascadian <vagrant@reproducible-builds.org>:
New Bug report received and forwarded. Copy sent to reproducible-bugs@lists.alioth.debian.org, Adam Cecile <acecile@le-vert.net>. (Sat, 13 Aug 2022 02:45:04 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>
To: submit@bugs.debian.org
Subject: python-suntime: reproducible builds: Timestamps recorded for all packaged files
Date: Fri, 12 Aug 2022 19:43:51 -0700
[Message part 1 (text/plain, inline)]
Source: python-suntime
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: timestamps locales
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

All the timestamps in python-suntime vary based on the build time:

  https://tests.reproducible-builds.org/debian/rb-pkg/bookworm/amd64/diffoscope-results/python-suntime.html

  1 	-rw-r--r--···0········0········0········4·2023-08-24·15:33:27.000000·debian-binary	1 	-rw-r--r--···0········0········0········4·2022-07-22·09:11:52.000000·debian-binary
  2 	-rw-r--r--···0········0········0·····1212·2023-08-24·15:33:27.000000·control.tar.xz	2 	-rw-r--r--···0········0········0·····1212·2022-07-22·09:11:52.000000·control.tar.xz
  3 	-rw-r--r--···0········0········0·····4196·2023-08-24·15:33:27.000000·data.tar.xz	3 	-rw-r--r--···0········0········0·····4200·2022-07-22·09:11:52.000000·data.tar.xz

This *should* be handled by dpkg, but for some reason it does not. At
first, I thought it might be the incorrectly formatted line in
debian/changelog:

-  Sandro Tosi <morph@debian.org>  Mon, 20 Jun 2022 23:02:36 -0400
+ -- Sandro Tosi <morph@debian.org>  Mon, 20 Jun 2022 23:02:36 -0400

But that doesn't seem to be the case; SOURCE_DATE_EPOCH is set at all
stages during the build, and fixing this doesn't change the results.

I'm not sure why... but forcing a consistant locale appears to
fix/workaround the issue. Patch attached which sets LC_ALL and LANG to
C.UTF-8 in debian/rules, does not trigger the issue.


With this patch applied, python-suntime should build reproducibly on
tests.reproducible-builds.org!


Thanks for maintaining python-suntime!


live well,
  vagrant
[0001-debian-rules-Set-LC_ALL-and-LANG-to-ensure-reproduci.patch (text/x-diff, inline)]
From 4adc1ba9ea7c004d819029c8273287091c50978f Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Sat, 13 Aug 2022 02:33:12 +0000
Subject: [PATCH] debian/rules: Set LC_ALL and LANG to ensure reproducible
 build.

The timestamps of all files seem to vary otherwise.
---
 debian/rules | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/debian/rules b/debian/rules
index fd7232c..b123c57 100755
--- a/debian/rules
+++ b/debian/rules
@@ -1,6 +1,8 @@
 #!/usr/bin/make -f
 
 export PYBUILD_NAME=suntime
+export LC_ALL=C.UTF-8
+export LANG=C.UTF-8
 
 %:
 	dh $@ --with python3 --buildsystem=pybuild
-- 
2.36.1

[signature.asc (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, reproducible-bugs@lists.alioth.debian.org, Adam Cecile <acecile@le-vert.net>:
Bug#1017073; Package src:python-suntime. (Fri, 09 Sep 2022 19:03:03 GMT) (full text, mbox, link).


Acknowledgement sent to James Addison <jay@jp-hosting.net>:
Extra info received and forwarded to list. Copy sent to reproducible-bugs@lists.alioth.debian.org, Adam Cecile <acecile@le-vert.net>. (Fri, 09 Sep 2022 19:03:03 GMT) (full text, mbox, link).


Message #10 received at 1017073@bugs.debian.org (full text, mbox, reply):

From: James Addison <jay@jp-hosting.net>
To: Debian Bug Tracking System <1017073@bugs.debian.org>
Subject: Re: python-suntime: reproducible builds: Timestamps recorded for all packaged files
Date: Fri, 09 Sep 2022 20:01:05 +0100
Source: python-suntime
Followup-For: Bug #1017073
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

Hi vagrant,

From some local builds here, you may have been onto something when you noticed
the formatting inconsistency in the debian/changelog file.

When I try building python-suntime from source locally, the locale exports in
the patch *don't* seem to fix the problem; the mtimes of the debian-binary and
control.tar.xz files in the output deb file continue to vary during each build.

But: after correcting the most recent changelog line, the file mtimes become
stable.

Note: in addition to the formatting issue, the timestamps in the changelog file
are out-of-order -- the most recent changelog has a timestamp that is older
than the second-most-recent entry.

This may have happened during commit below, which was likely intended to update
the most-recent entry -- but did not, perhaps due to the formatting problem:

https://salsa.debian.org/python-team/packages/python-suntime/-/commit/af7c127cf54ba10d530024319979ccb4e268c5d0

Thanks,
James



Information forwarded to debian-bugs-dist@lists.debian.org, jay@jp-hosting.net, Debian Python Team <team+python@tracker.debian.org>:
Bug#1017073; Package src:python-suntime. (Wed, 28 Sep 2022 15:15:03 GMT) (full text, mbox, link).


Acknowledgement sent to James Addison <jay@jp-hosting.net>:
Extra info received and forwarded to list. Copy sent to jay@jp-hosting.net, Debian Python Team <team+python@tracker.debian.org>. (Wed, 28 Sep 2022 15:15:03 GMT) (full text, mbox, link).


Message #15 received at 1017073@bugs.debian.org (full text, mbox, reply):

From: James Addison <jay@jp-hosting.net>
To: Debian Bug Tracking System <1017073@bugs.debian.org>
Subject: Re: python-suntime: reproducible builds: Timestamps recorded for all packaged files
Date: Wed, 28 Sep 2022 16:11:55 +0100
Source: python-suntime
Followup-For: Bug #1017073
X-Debbugs-Cc: jay@jp-hosting.net
Control: close -1 1.2.5-5

The package's changelog format is valid again in salsa following a refresh[1] that re-combined a divergent development history.  Release 1.2.5-5 looks good in terms of build reproducibility.

[1] - https://salsa.debian.org/python-team/packages/python-suntime/-/commit/683a9656a89bdcade60fa6c8b839026fdf23f1e1



Marked as fixed in versions python-suntime/1.2.5-5. Request was from James Addison <jay@jp-hosting.net> to 1017073-submit@bugs.debian.org. (Wed, 28 Sep 2022 15:15:03 GMT) (full text, mbox, link).


Marked Bug as done Request was from James Addison <jay@jp-hosting.net> to 1017073-submit@bugs.debian.org. (Wed, 28 Sep 2022 15:15:04 GMT) (full text, mbox, link).


Notification sent to Vagrant Cascadian <vagrant@reproducible-builds.org>:
Bug acknowledged by developer. (Wed, 28 Sep 2022 15:15:04 GMT) (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Debian Python Team <team+python@tracker.debian.org>:
Bug#1017073; Package src:python-suntime. (Mon, 17 Oct 2022 12:30:02 GMT) (full text, mbox, link).


Acknowledgement sent to "LIAM B. OMARI" <pegxukosuz@outlook.com>:
Extra info received and forwarded to list. Copy sent to Debian Python Team <team+python@tracker.debian.org>. (Mon, 17 Oct 2022 12:30:02 GMT) (full text, mbox, link).


Message #26 received at 1017073@bugs.debian.org (full text, mbox, wrote: > > > Your reputable profile gives me the impression that you will be a suitable partner in a crude oil licensing operations venture involving the National Oil Company of Equatorial Guinea (GEPetrol) and the company I work for which is Sinopec Group. This venture will see us netting in $14m in Revenue approximately per transaction. > > > On your response I will give you clearer details of this operation. I can be reached directly with the following email account; boey.mangue@gmail.com > > > Regards, > > Mangue Boey. > &References=">reply):

From: "LIAM B. OMARI" <pegxukosuz@outlook.com>
Subject: For your kind attention!
Date: Mon, 17 Oct 2022 12:26:19 +0000
[Message part 1 (text/plain, inline)]
Your reputable profile gives me the impression that you will be a suitable partner in a crude oil licensing operations venture involving the National Oil Company of Equatorial Guinea (GEPetrol) and the company I work for which is Sinopec Group. This venture will see us netting in $14m in Revenue approximately per transaction.


On your response I will give you clearer details of this operation. I can be reached directly with the following email account;  boey.mangue@gmail.com


Regards,

Mangue Boey.

[Message part 2 (text/html, inline)]

Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Tue, 15 Nov 2022 07:29:23 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Fri Jan 31 00:27:25 2025; Machine Name: bembo

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU General Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.