FS#70303 - [zssh] Package is unreproducible due to embedded timestamp

Attached to Project: Community Packages
Opened by Z. Ren (zren) - Monday, 05 April 2021, 15:48 GMT
Last edited by Toolybird (Toolybird) - Tuesday, 09 May 2023, 04:21 GMT
Task Type Bug Report
Category Reproducible Builds
Status Closed
Assigned To Felix Yan (felixonmars)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Hi!

While conducting a research in the spirit of the "reproducible builds" [1], we have noticed that the package zssh could not be built reproducibly, in that the output of the `date` command is captured and embedded. According to the documentation [2], if we replace `date` with `date --date=@$SOURCE_DATE_EPOCH`, and setting the environment variable $SOURCE_DATE_EPOCH (e.g., from .BUILDINFO as in the tool repro[2]) for reproducibility validation, the unreproducible issue will be resolved.

The attached patch does exactly this. Once applied, the package can be built reproducibly. Alternatively, for this package, simply removing `date` also works.

Additional info:
* zssh 1.5c-12

Steps to reproduce:
The unreproducible build result could be detected with reprotest/repro [2].

[1]: https://wiki.debian.org/ReproducibleBuilds
[2]: https://wiki.archlinux.org/index.php/DeveloperWiki:ReproducibleBuilds

Best wishes
   diff.json (2.9 KiB)
   zssh-reproducible.diff (0.5 KiB)
This task depends upon

Closed by  Toolybird (Toolybird)
Tuesday, 09 May 2023, 04:21 GMT
Reason for closing:  Fixed
Additional comments about closing:  zssh 1.5c-13
Comment by Z. Ren (zren) - Monday, 05 April 2021, 19:15 GMT
BTW, I just noticed here [1] that TZ and LANG may influence the date result. In this case, using `TZ=UTC LANG=C date --date=@$SOURCE_DATE_EPOCH` seems better?
[1] https://tests.reproducible-builds.org/archlinux/archlinux.html

Loading...