FS#70331 - [csound] Package is unreproducible due to the timestamp embedded in .jar file

Attached to Project: Community Packages
Opened by Z. Ren (zren) - Wednesday, 07 April 2021, 11:09 GMT
Last edited by Brett Cornwall (ainola) - Saturday, 10 April 2021, 23:44 GMT
Task Type Bug Report
Category Reproducible Builds
Status Closed
Assigned To David Runge (dvzrv)
Brett Cornwall (ainola)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Hi!

While conducting a research in the spirit of the "reproducible builds" [1], we have noticed that the package csound could not be built reproducibly, in that timestamp will be embedded when jar file(s) are generated (see attached diff.json). According to the documentation [2], applying strip-nondeterminism will strip non-deterministic information such as timestamps and filesystem ordering. The attached patch does exactly this. Once applied, the package can be built reproducibly.


Additional info:
* csound 6.15.0-2

Steps to reproduce:
The unreproducible build result could be detected with reprotest [3].

[1]: https://reproducible-builds.org
[2]: https://reproducible-builds.org/docs/archives/#post-processing
[3]: https://wiki.archlinux.org/index.php/DeveloperWiki:ReproducibleBuilds

Best wishes
   diff.json (17.6 KiB)
   csound-reproducible.diff (0.9 KiB)
This task depends upon

Closed by  Brett Cornwall (ainola)
Saturday, 10 April 2021, 23:44 GMT
Reason for closing:  Fixed
Additional comments about closing:  Thanks for reporting this! I've included the patch and tested csound 6.15.0-3 to be reproducible with repro -- csound-6.15.0-3-x86_64.pkg.tar.zst with success.

Loading...