961764">

Debian Bug report logs - #961764
texi2html: texi2html embeds User and Date information in generated .html files

version graph

Package: texi2html; Maintainer for texi2html is Anthony Fok <foka@debian.org>; Source for texi2html is src:texi2html (PTS, buildd, popcon).

Reported by: Vagrant Cascadian <vagrant@reproducible-builds.org>

Date: Fri, 29 May 2020 01:15:04 UTC

Severity: normal

Tags: patch

Fixed in version texi2html/1.82+dfsg1-6

Done: Vagrant Cascadian <vagrant@reproducible-builds.org>

Bug is archived. No further changes may be made.

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, reproducible-bugs@lists.alioth.debian.org, Debian QA Group <packages@qa.debian.org>:
Bug#961764; Package texi2html. (Fri, 29 May 2020 01:15:06 GMT) (full text, mbox, link).


Acknowledgement sent to Vagrant Cascadian <vagrant@reproducible-builds.org>:
New Bug report received and forwarded. Copy sent to reproducible-bugs@lists.alioth.debian.org, Debian QA Group <packages@qa.debian.org>. (Fri, 29 May 2020 01:15:06 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: texi2html: texi2html embeds User and Date information in generated .html files
Date: Thu, 28 May 2020 18:13:32 -0700
[Message part 1 (text/plain, inline)]
Package: texi2html
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: toolchain timestamps username
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

Files generated by texi2html often embed the build user and build date.

The attached patch removes the code which embeds the build date and
build user in order to achieve reproducible builds for the texi2html
package itself, as well as several other packages identified by the
reproducible builds project:

  https://tests.reproducible-builds.org/debian/issues/unstable/texi2html_captures_users_gecos_issue.html

Maybe additional packages would benefit from this patch as well.


Unfortunately, texi2html appears dead upstream, so I'm not sure there's
anywhere to forward this patch to.


live well,
  vagrant

[strip-out-user-and-date-from-generated-d.patch (text/x-diff, inline)]
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Fri, 29 May 2020 00:27:27 +0000
X-Dgit-Generated: 1.82+dfsg1-5 990d56af9f181e30e6a2315766afed1040a6ca7b
Subject: Strip out user and date from generated documentation to ensure

reproducible builds.

---

--- texi2html-1.82+dfsg1.orig/texi2html.init
+++ texi2html-1.82+dfsg1/texi2html.init
@@ -1325,25 +1325,6 @@ EOT
 
 sub T2H_DEFAULT_program_string()
 {
-    my $user = $Texi2HTML::THISDOC{'user'};
-    my $date = $Texi2HTML::THISDOC{'today'};
-    $user = '' if (!defined($user));
-    $date = '' if (!defined($date));
-    if (($user ne '') and ($date ne ''))
-    {
-        return  &$I('This document was generated by @emph{%{user}} on @emph{%{date}} using @uref{%{program_homepage}, @emph{%{program}}}.', {
-           'user' => $user, 'date' => $date, 'program_homepage' => $Texi2HTML::THISDOC{'program_homepage'}, 'program' => $Texi2HTML::THISDOC{'program'} }, {'duplicate'=>1});
-    }
-    elsif ($user ne '')
-    {
-        return  &$I('This document was generated by @emph{%{user}} using @uref{%{program_homepage}, @emph{%{program}}}.', {
-           'user' => $user, 'program_homepage' => $Texi2HTML::THISDOC{'program_homepage'}, 'program' => $Texi2HTML::THISDOC{'program'} }, {'duplicate'=>1});
-    }
-    elsif ($date ne '')
-    {
-        return  &$I('This document was generated on @i{%{date}} using @uref{%{program_homepage}, @i{%{program}}}.', {
-           'date' => $date, 'program_homepage' => $Texi2HTML::THISDOC{'program_homepage'}, 'program' => $Texi2HTML::THISDOC{'program'} },{'duplicate'=>1});
-    }
     return &$I('This document was generated using @uref{%{program_homepage}, @emph{%{program}}}.', {
        'program_homepage' => $Texi2HTML::THISDOC{'program_homepage'}, 'program'
 => $Texi2HTML::THISDOC{'program'} },{'duplicate'=>1});
[signature.asc (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Debian QA Group <packages@qa.debian.org>:
Bug#961764; Package texi2html. (Mon, 16 Nov 2020 01:09:02 GMT) (full text, mbox, link).


Acknowledgement sent to Vagrant Cascadian <vagrant@reproducible-builds.org>:
Extra info received and forwarded to list. Copy sent to Debian QA Group <packages@qa.debian.org>. (Mon, 16 Nov 2020 01:09:02 GMT) (full text, mbox, link).


Message #10 received at 961764@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>
To: 961764@bugs.debian.org
Cc: debian-qa@lists.debian.org, reproducible-builds@lists.alioth.debian.org
Subject: Re: #961764: texi2html: texi2html embeds User and Date information in generated .html files
Date: Sun, 15 Nov 2020 17:04:53 -0800
[Message part 1 (text/plain, inline)]
On 2020-05-28, Vagrant Cascadian wrote:
> Files generated by texi2html often embed the build user and build date.

It turns out the build date used respects SOURCE_DATE_EPOCH, so the date
is not a big issue.


> The attached patch removes the code which embeds the build date and
> build user in order to achieve reproducible builds for the texi2html
> package itself, as well as several other packages identified by the
> reproducible builds project:
>
>   https://tests.reproducible-builds.org/debian/issues/unstable/texi2html_captures_users_gecos_issue.html
>
> Maybe additional packages would benefit from this patch as well.

I've tested the attached a simpler one-line patch that removes the
default user value rather than the entire code handling user and date.

I've read:

  https://wiki.debian.org/qa.debian.org

But did not see anything about what the process for a QA upload was...


As this fixes reproducibility issues in several packages, it would be
nice to see this included in time for bullseye!

Thanks for your review, and please let me know if I should proceed with
the upload, or any changes to make, or process to follow, etc.


live well,
  vagrant

[texi2html.debdiff.diff (text/x-diff, inline)]
diff -Nru texi2html-1.82+dfsg1/debian/changelog texi2html-1.82+dfsg1/debian/changelog
--- texi2html-1.82+dfsg1/debian/changelog	2015-12-23 10:06:38.000000000 -0800
+++ texi2html-1.82+dfsg1/debian/changelog	2020-11-15 16:42:38.000000000 -0800
@@ -1,3 +1,10 @@
+texi2html (1.82+dfsg1-6) unstable; urgency=medium
+
+  * QA upload.
+  * Do not embed the build user in html files (Closes: #961764).
+
+ -- Vagrant Cascadian <vagrant@reproducible-builds.org>  Sun, 15 Nov 2020 16:42:38 -0800
+
 texi2html (1.82+dfsg1-5) unstable; urgency=medium
 
   * QA upload.
diff -Nru texi2html-1.82+dfsg1/debian/patches/do-not-embed-the-build-user-in-html-file.patch texi2html-1.82+dfsg1/debian/patches/do-not-embed-the-build-user-in-html-file.patch
--- texi2html-1.82+dfsg1/debian/patches/do-not-embed-the-build-user-in-html-file.patch	1969-12-31 16:00:00.000000000 -0800
+++ texi2html-1.82+dfsg1/debian/patches/do-not-embed-the-build-user-in-html-file.patch	2020-11-15 16:42:38.000000000 -0800
@@ -0,0 +1,21 @@
+From: Vagrant Cascadian <vagrant@reproducible-builds.org>
+Date: Sun, 15 Nov 2020 19:26:28 +0000
+X-Dgit-Generated: 1.82+dfsg1-6 914779331fe9fed1dfd59830fa18994884c00368
+Subject: Do not embed the build user in html files (Closes: #961764).
+
+Bug-Debian: https://bugs.debian.org/961764
+Forwarded: no
+Last-Update: 2020-11-15
+
+---
+
+--- texi2html-1.82+dfsg1.orig/texi2html.pl
++++ texi2html-1.82+dfsg1/texi2html.pl
+@@ -7164,7 +7164,6 @@ sub pass_text($$)
+     $Texi2HTML::THISDOC{'program'} = $THISPROG;
+     $Texi2HTML::THISDOC{'program_homepage'} = $T2H_HOMEPAGE;
+     $Texi2HTML::THISDOC{'program_authors'} = $T2H_AUTHORS;
+-    $Texi2HTML::THISDOC{'user'} = $T2H_USER;
+     $Texi2HTML::THISDOC{'user'} = $Texi2HTML::Config::USER if (defined($Texi2HTML::Config::USER));
+     $Texi2HTML::THISDOC{'authors'} = [] if (!defined($Texi2HTML::THISDOC{'authors'}));
+     $Texi2HTML::THISDOC{'subtitles'} = [] if (!defined($Texi2HTML::THISDOC{'subtitles'}));
diff -Nru texi2html-1.82+dfsg1/debian/patches/series texi2html-1.82+dfsg1/debian/patches/series
--- texi2html-1.82+dfsg1/debian/patches/series	2015-12-23 09:33:22.000000000 -0800
+++ texi2html-1.82+dfsg1/debian/patches/series	2020-11-15 16:42:38.000000000 -0800
@@ -3,3 +3,4 @@
 03_add_build-date_param.patch
 04_sort-perl-hash
 05_reproducible-build
+do-not-embed-the-build-user-in-html-file.patch
[signature.asc (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Debian QA Group <packages@qa.debian.org>:
Bug#961764; Package texi2html. (Mon, 16 Nov 2020 03:15:04 GMT) (full text, mbox, link).


Acknowledgement sent to Vagrant Cascadian <vagrant@reproducible-builds.org>:
Extra info received and forwarded to list. Copy sent to Debian QA Group <packages@qa.debian.org>. (Mon, 16 Nov 2020 03:15:04 GMT) (full text, mbox, link).


Message #15 received at 961764@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>
To: 961764@bugs.debian.org
Cc: debian-qa@lists.debian.org, reproducible-builds@lists.alioth.debian.org
Subject: Re: #961764: texi2html: texi2html embeds User and Date information in generated .html files
Date: Sun, 15 Nov 2020 19:10:47 -0800
[Message part 1 (text/plain, inline)]
On 2020-11-15, Vagrant Cascadian wrote:
> On 2020-05-28, Vagrant Cascadian wrote:
>> Files generated by texi2html often embed the build user and build date.
...
> I've tested the attached a simpler one-line patch that removes the
> default user value rather than the entire code handling user and date.
>
> I've read:
>
>   https://wiki.debian.org/qa.debian.org
>
> But did not see anything about what the process for a QA upload was...
>
> As this fixes reproducibility issues in several packages, it would be
> nice to see this included in time for bullseye!
>
> Thanks for your review, and please let me know if I should proceed with
> the upload, or any changes to make, or process to follow, etc.

Well, pabs pointed me to the devref and encouraged me to upload.

I made some additional relatively trivial fixes to the packages and
uploaded via dgit.

Thanks!

live well,
  vagrant
[signature.asc (application/pgp-signature, inline)]

Reply sent to Vagrant Cascadian <vagrant@reproducible-builds.org>:
You have taken responsibility. (Mon, 16 Nov 2020 03:21:04 GMT) (full text, mbox, link).


Notification sent to Vagrant Cascadian <vagrant@reproducible-builds.org>:
Bug acknowledged by developer. (Mon, 16 Nov 2020 03:21:05 GMT) (full text, mbox, link).


Message #20 received at 961764-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>
To: 961764-close@bugs.debian.org
Subject: Bug#961764: fixed in texi2html 1.82+dfsg1-6
Date: Mon, 16 Nov 2020 03:18:28 +0000
Source: texi2html
Source-Version: 1.82+dfsg1-6
Done: Vagrant Cascadian <vagrant@reproducible-builds.org>

We believe that the bug you reported is fixed in the latest version of
texi2html, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 961764@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Vagrant Cascadian <vagrant@reproducible-builds.org> (supplier of updated texi2html package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 15 Nov 2020 18:57:14 -0800
Source: texi2html
Architecture: source
Version: 1.82+dfsg1-6
Distribution: unstable
Urgency: medium
Maintainer: Debian QA Group <packages@qa.debian.org>
Changed-By: Vagrant Cascadian <vagrant@reproducible-builds.org>
Closes: 961764
Changes:
 texi2html (1.82+dfsg1-6) unstable; urgency=medium
 .
   * QA upload.
   * debian/patches:
     - Do not embed the build user in html files (Closes: #961764).
   * debian/control:
     - Set Rules-Requres-Root to no.
     - Update to debhelper-compat 13.
     - Drop dh-autoreconf from Build-Depends.
     - Delete trailing whitespace.
     - Update Standards-Version to 4.5.0.
   * debian/changelog:
     - Remove trailing whitespace.
Checksums-Sha1:
 5134dacd9d9a6553e52dc1611a0477c251403ff5 1333 texi2html_1.82+dfsg1-6.dsc
 96a643d580fd291b91fefbdb30f28c216925fe73 7672 texi2html_1.82+dfsg1-6.debian.tar.xz
Checksums-Sha256:
 460f2757e5b6cfe73e77a0d062c911ba217ef3d56399f11c8ebfa3584652b3e6 1333 texi2html_1.82+dfsg1-6.dsc
 2284d807aff1483064ae4143030cc2e4d5bb0d4c1e069d8f21a5fdcca44e1b2f 7672 texi2html_1.82+dfsg1-6.debian.tar.xz
Files:
 0579abaeccab639b6f5ee34942f73bea 1333 text optional texi2html_1.82+dfsg1-6.dsc
 661c175b44fe1d7d5a6fa5fbf7092cd3 7672 text optional texi2html_1.82+dfsg1-6.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iJYEARYKAD4WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCX7HstyAcdmFncmFudEBy
ZXByb2R1Y2libGUtYnVpbGRzLm9yZwAKCRDcUY/If5cWqnLKAQCSSPz45UCdd1UD
2Mgi2S19plzMW5A+ZNU68/cVaczgIQD/TZ1q81aIPhdfzSaF564lYt17Ddbo8XxQ
dC1s2njdIQg=
=AbNp
-----END PGP SIGNATURE-----




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sat, 19 Dec 2020 07:29:01 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Mon Feb 3 05:54:56 2025; Machine Name: bembo

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU General Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.