Acknowledgement sent
to Vagrant Cascadian <vagrant@reproducible-builds.org>:
New Bug report received and forwarded. Copy sent to reproducible-bugs@lists.alioth.debian.org, Russell Coker <russell@coker.com.au>.
(Mon, 26 Sep 2022 01:45:04 GMT) (full text, mbox, link).
Source: postal
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: buildpath
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org
The build path is embedded in various binaries:
https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/postal.html
/usr/bin/postal-list
/build/1st/postal-0.76+nmu1/expand.cpp:14·(discriminator·2)
vs.
/build/2/postal-0.76+nmu1/2nd/expand.cpp:14·(discriminator·2)
The attached patch to debian/rules fixes this by passing the default
CFLAGS to make.
Alternately, updating to use dh and a recent debhelper compat version
might also fix this.
With this patch applied postal should build reproducibly on
tests.reproducible-builds.org!
Thanks for maintaining postal!
live well,
vagrant
Information forwarded
to Russell Coker <russell@coker.com.au>: Bug#1020759; Package src:postal.
(Tue, 12 Mar 2024 22:36:42 GMT) (full text, mbox, link).
Acknowledgement sent
to James Addison <jay@jp-hosting.net>:
Extra info received and forwarded to maintainer. Copy sent to Russell Coker <russell@coker.com.au>.
(Tue, 12 Mar 2024 22:36:42 GMT) (full text, mbox, link).
Control: severity -1 wishlist
Dear Maintainer,
Because Debian builds packages from a fixed build path, neither the 'reprotest'
utility in Salsa-CI, nor the Reproducible Builds team's package test
infrastructure for Debian[1] currently check for equivalent binary package
output from differing source package build paths.
This means that your package will pass current reproducibility tests; however
we believe that source code and/or build steps still embed the build path into
the binary package output, making it more difficult than necessary for
independent consumers to check the integrity of those packages by rebuilding
them themselves.
As a result, this bugreport will remain open and be re-assigned the 'wishlist'
severity[2].
For more information about build paths and how they can affect reproducibility,
please refer to: https://reproducible-builds.org/docs/build-path/
Thanks,
James
[1] - https://tests.reproducible-builds.org/debian/reproducible.html
[2] - https://www.debian.org/Bugs/Developer#severities
Severity set to 'wishlist' from 'normal'
Request was from James Addison <jay@jp-hosting.net>
to 1020759-maintonly@bugs.debian.org.
(Tue, 12 Mar 2024 22:36:43 GMT) (full text, mbox, link).
Information forwarded
to Russell Coker <russell@coker.com.au>: Bug#1020759; Package src:postal.
(Wed, 13 Mar 2024 09:21:28 GMT) (full text, mbox, link).
Acknowledgement sent
to James Addison <jay@jp-hosting.net>:
Extra info received and forwarded to maintainer. Copy sent to Russell Coker <russell@coker.com.au>.
(Wed, 13 Mar 2024 09:21:28 GMT) (full text, mbox, link).
A correction for a mistake in my previous message:
> Because Debian builds packages from a fixed build path, neither the 'reprotest'
> utility in Salsa-CI, nor the Reproducible Builds team's package test
> infrastructure for Debian[1] currently check for equivalent binary package
> output from differing source package build paths.
>
> This means that your package will pass current reproducibility tests; ...
> [ snip ]
Currently the 'reprotest' job in Salsa-CI does in fact continue to exercise
variations of the build-path, and will fail if it builds binary packages that
contain different contents as a result.
Reply sent
to Bastian Germann <bage@debian.org>:
You have taken responsibility.
(Wed, 19 Jun 2024 15:51:06 GMT) (full text, mbox, link).
Notification sent
to Vagrant Cascadian <vagrant@reproducible-builds.org>:
Bug acknowledged by developer.
(Wed, 19 Jun 2024 15:51:07 GMT) (full text, mbox, link).
Source: postal
Source-Version: 0.76+nmu2
Done: Bastian Germann <bage@debian.org>
We believe that the bug you reported is fixed in the latest version of
postal, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1020759@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Bastian Germann <bage@debian.org> (supplier of updated postal package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 09 Jun 2024 14:43:03 +0000
Source: postal
Architecture: source
Version: 0.76+nmu2
Distribution: unstable
Urgency: medium
Maintainer: Russell Coker <russell@coker.com.au>
Changed-By: Bastian Germann <bage@debian.org>
Closes: 92811410075211020759
Changes:
postal (0.76+nmu2) unstable; urgency=medium
.
* Non-maintainer upload.
* Convert to source format 3.0. Closes: #1007521
.
[ Helmut Grohne ]
* Let dh_auto_configure pass --host to ./configure. Closes: #928114
.
[ Vagrant Cascadian ]
* Pass the default CFLAGS to make. Closes: #1020759
Checksums-Sha1:
ae5064e014c077050f779a08d721164fd2d9255d 1419 postal_0.76+nmu2.dsc
9bd868cc6083a3115aa3ccc701186eebbcca62f5 74460 postal_0.76+nmu2.tar.xz
5e4fa66b928dddb7a3f0a8fa4308e4ee03deb38b 5731 postal_0.76+nmu2_source.buildinfo
Checksums-Sha256:
620b0baed5037d0b1422dca2b2908b5264326778022384d6426d01dc82ee9157 1419 postal_0.76+nmu2.dsc
0b5210dbc3e1c1c655d006338ac3d6fb64cc761ee7cb5364c8997880ca43ca03 74460 postal_0.76+nmu2.tar.xz
6e72a46a2b5e482c22f36eb518d305f1ece4f5b82b91e14cf6085d5f0229c0b5 5731 postal_0.76+nmu2_source.buildinfo
Files:
3d364139b3b828bf5375beffdb38c331 1419 utils optional postal_0.76+nmu2.dsc
659668f21032b2f50744e07392b7cd22 74460 utils optional postal_0.76+nmu2.tar.xz
a9277c69d96118ec54dcc89269d13e3e 5731 utils optional postal_0.76+nmu2_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQHEBAEBCgAuFiEEQGIgyLhVKAI3jM5BH1x6i0VWQxQFAmZlwb0QHGJhZ2VAZGVi
aWFuLm9yZwAKCRAfXHqLRVZDFBN+C/9YP1DvpKbDdkYLcmVtVmWrc9hc6cSoNTgk
Zg3V7fWJnD1/jwRnUKnUWFIVIuldm1D+uHRjgFYq58lZRgrcC9f2YGxQd1GFdxLQ
u9SbfEa3cVBL8V5+uRuRNa1A4t7akmZBSPs4fU+7NhtqgYzknkMoEWOm3lVkAI2o
dx3A64U2U3PMNKa393O+V2NebCrFnqHgEE2ect5wuuBGVNA8WF+/zcAL2ST9qL3/
D5tmu+RZkasuKHL9jYTT4ntpxVx0heWAZcdUFf+dFLeR43Rv67+uG3WvAloyYVMH
I5cgt0xr6w2rFhDABU2Dh5a3MAJ8QjA0oHlXGra1QfV7EwKdWSCdRZyvZVVLFq0D
G4185hDyBNMdYv44dM22ozOJE4uD+t43+0jiybz7p/kr1G0g7lAivTxKNjiokAwv
v0VzjPD1TjP+IUn0VPkLdsVj7TNw4wxs4pjJ5q/jqLVQ8bDOu1ON7pxw2hL4mK32
pvxHxqHibskHbp3fIqzuLH9eXA0TfoQ=
=DKDN
-----END PGP SIGNATURE-----
Debbugs is free software and licensed under the terms of the GNU General
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.