968627">

Debian Bug report logs - #968627
libjpeg-turbo: Use UTC timestamp for build date

version graph

Package: src:libjpeg-turbo; Maintainer for src:libjpeg-turbo is Ondřej Surý <ondrej@debian.org>;

Reported by: Vagrant Cascadian <vagrant@reproducible-builds.org>

Date: Tue, 18 Aug 2020 19:12:01 UTC

Severity: normal

Tags: patch

Found in version libjpeg-turbo/1:2.0.5-1.1

Fixed in version libjpeg-turbo/1:2.0.5-2

Done: Mike Gabriel <sunweaver@debian.org>

Bug is archived. No further changes may be made.

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, reproducible-bugs@lists.alioth.debian.org, Ondřej Surý <ondrej@debian.org>:
Bug#968627; Package src:libjpeg-turbo. (Tue, 18 Aug 2020 19:12:03 GMT) (full text, mbox, link).


Acknowledgement sent to Vagrant Cascadian <vagrant@reproducible-builds.org>:
New Bug report received and forwarded. Copy sent to reproducible-bugs@lists.alioth.debian.org, Ondřej Surý <ondrej@debian.org>. (Tue, 18 Aug 2020 19:12:03 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: libjpeg-turbo: Use UTC timestamp for build date
Date: Tue, 18 Aug 2020 12:08:10 -0700
[Message part 1 (text/plain, inline)]
Source: libjpeg-turbo
Severity: normal
Version: 1:2.0.5-1.1
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: timezone
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

The build date is embedded in various files such as libjpeg.so.62.3.0:

  libjpeg-turbo·version·2.0.5·(build·20200731)	vs. libjpeg-turbo·version·2.0.5·(build·20200801)


While CMake respects SOURCE_DATE_EPOCH, it still can produce a different
date depending on the timezone of the running system.

Applying the attached patch explicitly sets the timezone to UTC and
should result in a reproducible build for bullseye:

  https://tests.reproducible-builds.org/debian/libjpeg-turbo

There may be other reproducibility issues caused by changing build path
for sid tests that are not addressed by this patch.

Thanks for maintaining libjpeg-turbo!

live well,
  vagrant

[0001-Add-patch-to-use-UTC-timestamp-to-enable-reproducibl.patch (text/x-diff, inline)]
From 9a7f5e988f982f0e957eb08ad9122388ba376569 Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Tue, 18 Aug 2020 18:47:02 +0000
Subject: [PATCH] Add patch to use UTC timestamp to enable reproducible build.

---
 debian/patches/1001-use-utc-timestamp.patch | 21 +++++++++++++++++++++
 debian/patches/series                       |  1 +
 2 files changed, 22 insertions(+)
 create mode 100644 debian/patches/1001-use-utc-timestamp.patch

diff --git a/debian/patches/1001-use-utc-timestamp.patch b/debian/patches/1001-use-utc-timestamp.patch
new file mode 100644
index 0000000..e689e4d
--- /dev/null
+++ b/debian/patches/1001-use-utc-timestamp.patch
@@ -0,0 +1,21 @@
+Author: Vagrant Cascadian <vagrant@reproducible-builds.org>
+Description: Use UTC timezone for build timestamp
+
+While CMake respects SOURCE_DATE_EPOCH, it still can produce a
+different date depending on the timezone of the running system.
+
+Specify timezone in UTC to enable a reproducible build.
+
+Index: libjpeg-turbo/CMakeLists.txt
+===================================================================
+--- libjpeg-turbo.orig/CMakeLists.txt
++++ libjpeg-turbo/CMakeLists.txt
+@@ -25,7 +25,7 @@ pad_number(VERSION_MINOR 3)
+ pad_number(VERSION_REVISION 3)
+ set(LIBJPEG_TURBO_VERSION_NUMBER ${VERSION_MAJOR}${VERSION_MINOR}${VERSION_REVISION})
+ 
+-string(TIMESTAMP DEFAULT_BUILD "%Y%m%d")
++string(TIMESTAMP DEFAULT_BUILD "%Y%m%d" UTC)
+ set(BUILD ${DEFAULT_BUILD} CACHE STRING "Build string (default: ${DEFAULT_BUILD})")
+ 
+ # NOTE: On Windows, this does nothing except when using MinGW or Cygwin.
diff --git a/debian/patches/series b/debian/patches/series
index 281f1c6..c226907 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1 +1,2 @@
+1001-use-utc-timestamp.patch
 2001_dont-set-RPATH.patch
-- 
2.28.0

[signature.asc (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Ondřej Surý <ondrej@debian.org>:
Bug#968627; Package src:libjpeg-turbo. (Fri, 01 Jan 2021 19:33:02 GMT) (full text, mbox, link).


Acknowledgement sent to Vagrant Cascadian <vagrant@reproducible-builds.org>:
Extra info received and forwarded to list. Copy sent to Ondřej Surý <ondrej@debian.org>. (Fri, 01 Jan 2021 19:33:02 GMT) (full text, mbox, link).


Message #10 received at 968627@bugs.debian.org (full text, mbox, > ++string(TIMESTAMP DEFAULT_BUILD "%Y%m%d" UTC) > > + set(BUILD ${DEFAULT_BUILD} CACHE STRING "Build string (default: ${DEFAULT_BUILD})") > > + > > + # NOTE: On Windows, this does nothing except when using MinGW or Cygwin. > > diff --git a/debian/patches/series b/debian/patches/series > > index 281f1c6..c226907 100644 > > --- a/debian/patches/series > > +++ b/debian/patches/series > > @@ -1 +1,2 @@ > > +1001-use-utc-timestamp.patch > > 2001_dont-set-RPATH.patch > > -- > > 2.28.0 > > Any chance we can see this applied in time for bullseye? > > The maintainer field indicates https://wiki.debian.org/LowThresholdNmu > so I guess I'll proceed with an NMU unless I hear otherwise soon. > > > live well, > vagrant &subject=Re: #968627: libjpeg-turbo: Use UTC timestamp for build date&References=<871rk3n55x.fsf@ponder> <87o8i8sbdx.fsf@yucca>&In-Reply-To=<87o8i8sbdx.fsf@yucca>">reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>
To: 968627@bugs.debian.org
Subject: Re: #968627: libjpeg-turbo: Use UTC timestamp for build date
Date: Fri, 01 Jan 2021 11:30:34 -0800
[Message part 1 (text/plain, inline)]
On 2020-08-18, Vagrant Cascadian wrote:
> From 9a7f5e988f982f0e957eb08ad9122388ba376569 Mon Sep 17 00:00:00 2001
> From: Vagrant Cascadian <vagrant@reproducible-builds.org>
> Date: Tue, 18 Aug 2020 18:47:02 +0000
> Subject: [PATCH] Add patch to use UTC timestamp to enable reproducible build.
>
> ---
>  debian/patches/1001-use-utc-timestamp.patch | 21 +++++++++++++++++++++
>  debian/patches/series                       |  1 +
>  2 files changed, 22 insertions(+)
>  create mode 100644 debian/patches/1001-use-utc-timestamp.patch
>
> diff --git a/debian/patches/1001-use-utc-timestamp.patch b/debian/patches/1001-use-utc-timestamp.patch
> new file mode 100644
> index 0000000..e689e4d
> --- /dev/null
> +++ b/debian/patches/1001-use-utc-timestamp.patch
> @@ -0,0 +1,21 @@
> +Author: Vagrant Cascadian <vagrant@reproducible-builds.org>
> +Description: Use UTC timezone for build timestamp
> +
> +While CMake respects SOURCE_DATE_EPOCH, it still can produce a
> +different date depending on the timezone of the running system.
> +
> +Specify timezone in UTC to enable a reproducible build.
> +
> +Index: libjpeg-turbo/CMakeLists.txt
> +===================================================================
> +--- libjpeg-turbo.orig/CMakeLists.txt
> ++++ libjpeg-turbo/CMakeLists.txt
> +@@ -25,7 +25,7 @@ pad_number(VERSION_MINOR 3)
> + pad_number(VERSION_REVISION 3)
> + set(LIBJPEG_TURBO_VERSION_NUMBER ${VERSION_MAJOR}${VERSION_MINOR}${VERSION_REVISION})
> + 
> +-string(TIMESTAMP DEFAULT_BUILD "%Y%m%d")
> ++string(TIMESTAMP DEFAULT_BUILD "%Y%m%d" UTC)
> + set(BUILD ${DEFAULT_BUILD} CACHE STRING "Build string (default: ${DEFAULT_BUILD})")
> + 
> + # NOTE: On Windows, this does nothing except when using MinGW or Cygwin.
> diff --git a/debian/patches/series b/debian/patches/series
> index 281f1c6..c226907 100644
> --- a/debian/patches/series
> +++ b/debian/patches/series
> @@ -1 +1,2 @@
> +1001-use-utc-timestamp.patch
>  2001_dont-set-RPATH.patch
> -- 
> 2.28.0

Any chance we can see this applied in time for bullseye?

The maintainer field indicates https://wiki.debian.org/LowThresholdNmu
so I guess I'll proceed with an NMU unless I hear otherwise soon.


live well,
  vagrant
[signature.asc (application/pgp-signature, inline)]

Reply sent to Mike Gabriel <sunweaver@debian.org>:
You have taken responsibility. (Fri, 01 Jan 2021 21:06:06 GMT) (full text, mbox, link).


Notification sent to Vagrant Cascadian <vagrant@reproducible-builds.org>:
Bug acknowledged by developer. (Fri, 01 Jan 2021 21:06:06 GMT) (full text, mbox, link).


Message #15 received at 968627-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>
To: 968627-close@bugs.debian.org
Subject: Bug#968627: fixed in libjpeg-turbo 1:2.0.5-2
Date: Fri, 01 Jan 2021 21:03:26 +0000
Source: libjpeg-turbo
Source-Version: 1:2.0.5-2
Done: Mike Gabriel <sunweaver@debian.org>

We believe that the bug you reported is fixed in the latest version of
libjpeg-turbo, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 968627@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mike Gabriel <sunweaver@debian.org> (supplier of updated libjpeg-turbo package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 01 Jan 2021 21:43:20 +0100
Source: libjpeg-turbo
Architecture: source
Version: 1:2.0.5-2
Distribution: unstable
Urgency: medium
Maintainer: Ondřej Surý <ondrej@debian.org>
Changed-By: Mike Gabriel <sunweaver@debian.org>
Closes: 897646 968627
Changes:
 libjpeg-turbo (1:2.0.5-2) unstable; urgency=medium
 .
   [ Debian Janitor ]
   * debian/copyright:
     + Use spaces rather than tabs to start continuation lines.
   * Set upstream metadata fields: Archive, Bug-Database, Bug-Submit, Repository,
     Repository-Browse.
 .
   [ Vagrant Cascadian ]
   * debian/patches:
     + Add 1001-use-utc-timestamp.patch. Use UTC timestamp to enable reproducible
       build. (Closes: #968627).
 .
   [ Helmut Grohne ]
   * debian/control:
     + Convert libjpeg-dev to Architecture: any. (Closes: #897646).
 .
   [ Mike Gabriel ]
   * debian/control:
     + Bump Standards-Version: to 4.5.1. No changes needed.
Checksums-Sha1:
 282e44feec1a8b9b30d9e938b20db5c797f154f9 2315 libjpeg-turbo_2.0.5-2.dsc
 c68981e0eac68a1806ad716c54455554f30cfcae 87828 libjpeg-turbo_2.0.5-2.debian.tar.xz
 e13e2dc34b9563f94b9758a28897a29cc248370e 5547 libjpeg-turbo_2.0.5-2_source.buildinfo
Checksums-Sha256:
 f5a49841f0f8d57a819e18933d14567e9cb0ef0d8092bf64c40369b996cee226 2315 libjpeg-turbo_2.0.5-2.dsc
 f03137a5e69a8179b962d23dafb71a7d67b468346331e113d328a79d9a3b15b4 87828 libjpeg-turbo_2.0.5-2.debian.tar.xz
 7d518ae82dd461eb881d9fa915d2a558ec9a0a833dc3dc616d5be29bebf648ef 5547 libjpeg-turbo_2.0.5-2_source.buildinfo
Files:
 df621c535a8069352b44780aaa234a18 2315 graphics optional libjpeg-turbo_2.0.5-2.dsc
 0413015698626173eaef4291807f9f3a 87828 graphics optional libjpeg-turbo_2.0.5-2.debian.tar.xz
 9ccb357bf4eee6344bbc2655f566a573 5547 graphics optional libjpeg-turbo_2.0.5-2_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJJBAEBCAAzFiEEm/uu6GwKpf+/IgeCmvRrMCV3GzEFAl/vijsVHHN1bndlYXZl
ckBkZWJpYW4ub3JnAAoJEJr0azAldxsxfTcQAItl0+c5frTx0g17sWehQtGn/EAw
qRU0qSi0wO9U7xen+nEraXhtcVuyPqDVJuJt5jAK5DmkvBrVKSix34ldFL8/J9DJ
pSzAazlsGTxJ3UbcB1+gTg3Izr0XS1LmlG9QBikYLx/8H89j+L8IsRY+eZ4cQOZD
9smjRWdmnIfaYvO7+9TkSAPPFmQ4y3B3p7RUwUuO3TAdhQgeZjG6oeAu23JgLDWK
XKytBBIpQCtIRpcVDCXpTYfOUKXjwdRFVxe1l47Dj0jdUKFruIXT9rYIrVIHvCI2
Pvea4axET3mVLnrg2WXSQw2bDHs98AGdEAkhUmPxDrTtWn4LJL4uwtNb4dxq6Csj
q+6s+IUVvRHkGbk7DiKAqk29KDLBjX1vvC4WLuh/5iz6Y6bqmcsbRCLncyMocJqv
H0ZMaKf4aNK36zbjuM4KMGHPD5Q4Xps9MOrZGCxkDz5mfnvK4UmpQ8zVD+O3rY4x
3VBKANwjyQ7/+fJSdnDkT2q2J5jzriwYjgM0rs+vqRaQNJuLUV0YxoZnTEA/l734
Vq6j+FkDAffQxtUOJix6nJ8OjfsKeSluER4LxYbMSbIaesjXBtmvetnC0/y3Oiku
2ALEC1JOzBv6uI+L6IkJXUCS/W2wjG4sHCjNFQvTT2kTmX07g4jf2hB4/nkus2Bu
Xl+CZTXbs4SOwY5x
=HpOS
-----END PGP SIGNATURE-----




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sat, 30 Jan 2021 07:25:29 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Fri Jan 31 00:32:13 2025; Machine Name: bembo

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU General Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.