Bug#891050: gap-autpgrp: please make the build reproducible

[Bill Allombert]

On Thu, Feb 22, 2018 at 08:51:05AM +, Chris Lamb wrote:
> Dear Bill,
> 
> > Upstream will never take it. This is not the right way to fix this bug
> > and you know it.
> 
> I'm afraid I was a little disappointed to read your response. 

Sorry, but I was also a little disappointed to see such patch
coming from an experienced Debian developer.

TeX-based build systems should be fixed to use SOURCE_DATE_EPOCH etc. to
generate reproducible timestamp rather than TeX documents to be altered to
avoid timestamps. Indeed reproducible builds has the potential to make
timestamp much more accurate and useful, so it would be a waste to remove
them. Avoiding timestamps is also unsustainable in the long run.

We should favor the long term solution over the quick fix.

In the event you did not actually intend the patch to be applied, then
sorry for the confusion.

> It is entirely feasible that upstream would agree with the sentiment
> that such timestamps are not useful (or even misleading) and thus
> should be removed. I have convinced countless developers in the past
> using this or similar arguments.

Alas, the upstream of this package does not even provide a Makefile to
build the documentation. Instead the PDF file is included in the
tarball. So as far as they are concerned the timestamp are always correct
and the user has no business rebuilding the documentation.

But what is magic with SOURCE_DATE_EPOCH and other improvements from the
reproducible build project is that we can arrange for the build system
to generate the exact same timestamps than in the upstream tarball,
which is much better than removing them.

Cheers,
-- 
Bill. 

Imagine a large red swirl here. 

Bug#891050: gap-autpgrp: please make the build reproducible

[Chris Lamb]

Dear Bill,

> Upstream will never take it. This is not the right way to fix this bug
> and you know it.

I'm afraid I was a little disappointed to read your response. 

It is entirely feasible that upstream would agree with the sentiment
that such timestamps are not useful (or even misleading) and thus
should be removed. I have convinced countless developers in the past
using this or similar arguments.

Furthermore, I did not enjoy being told "I know you know how to do
better" or being informed the patch is "a waste of time". Whatever
the merits of those statements, I could not help but interpret your
tone as needlessly hectoring and, at best, unproductive. As a project,
we should — and can — do better.

> I really mean gap-gapdoc, not this package.
[…] 
> The whole reproducible builds is anxiogen because there are no reliable
> tool to check a package is reproducible

(These are topics/questions outside the scope of this bug report; I fear
we would be doing them a disservice by attempting to cover them here.)


Regards,

-- 
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org / chris-lamb.co.uk
   `-

Bug#891050: gap-autpgrp: please make the build reproducible

[Bill Allombert]

On Wed, Feb 21, 2018 at 10:52:44PM +, Chris Lamb wrote:
> Hi Bill,
>  
> > If you want to help with GAP, tell me why gap-gapdoc is not reproducible.
> 
> I'm not sure I can tell you anything more beyond what was in my original
> report (ie. date variation due to the use of \Month and \Year).  :)

I really mean gap-gapdoc, not this package.

> (I can 100% understand not wanting to diverge from upstream and would
> certainly understand if you didn't want to take this patch before
> upstream do.)

Upstream will never take it. This is not the right way to fix this bug
and you know it.

I find it a waste of time to receive such patch. It does not include any
information not available from reproducible-builds.org and suggest an
incorrect course of action (instead of using FORCE_SOURCE_DATE,
SOURCE_DATE_EPOCH etc.).

I know you know how to do better!

The whole reproducible builds is anxiogen because there are no reliable
tool to check a package is reproducible according to policy before
uploading it to the archive. reproducible-builds.org is not a suitable
substitute in many aspect.

This is sad because this is an important project. But it is not worth
the stress each time one upload a package.

Cheers,
-- 
Bill. 

Imagine a large red swirl here.

Bug#891050: gap-autpgrp: please make the build reproducible

[Chris Lamb]

Hi Bill,
 
> If you want to help with GAP, tell me why gap-gapdoc is not reproducible.

I'm not sure I can tell you anything more beyond what was in my original
report (ie. date variation due to the use of \Month and \Year).  :)

(I can 100% understand not wanting to diverge from upstream and would
certainly understand if you didn't want to take this patch before
upstream do.)


Regards,

-- 
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org / chris-lamb.co.uk
   `-

Bug#891050: gap-autpgrp: please make the build reproducible

[Bill Allombert]

On Wed, Feb 21, 2018 at 10:34:26PM +, Chris Lamb wrote:
> Source: gap-autpgrp
> Version: 1.5-2
> Severity: wishlist
> Tags: patch
> User: reproducible-bui...@lists.alioth.debian.org
> Usertags: timestamps
> X-Debbugs-Cc: reproducible-b...@lists.alioth.debian.org
> 
> Hi,
> 
> Whilst working on the Reproducible Builds effort [0], we noticed
> that gap-autpgrp could not be built reproducibly:
> 
>  [0] https://reproducible-builds.org/

Hello Chris,
your patch causes the manual to be different from upstream. This is not
the goal of reproducible builds.

If you want to help with GAP, tell me why gap-gapdoc is not reproducible.

Cheers,
-- 
Bill. 

Imagine a large red swirl here.

Bug#891050: gap-autpgrp: please make the build reproducible

[Chris Lamb]

Source: gap-autpgrp
Version: 1.5-2
Severity: wishlist
Tags: patch
User: reproducible-bui...@lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-b...@lists.alioth.debian.org

Hi,

Whilst working on the Reproducible Builds effort [0], we noticed
that gap-autpgrp could not be built reproducibly:

│ │ │ ├── ./usr/share/gap/pkg/AutPGrp/doc/manual.pdf
│ │ │ │ ├── pdftotext {} -
│ │ │ │ │ @@ -2,15 +2,15 @@
│ │ │ │ │  —
│ │ │ │ │  A GAP4 Package
│ │ │ │ │  
│ │ │ │ │  by
│ │ │ │ │  
│ │ │ │ │  Bettina Eick and Eamonn O’Brien
│ │ │ │ │  
│ │ │ │ │ -March 2019
│ │ │ │ │ +February 2018

Patch attached.

 [0] https://reproducible-builds.org/


Regards,

-- 
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org / chris-lamb.co.uk
   `-
--- a/debian/patches/reproducible-build.patch   1970-01-01 01:00:00.0 
+0100
--- b/debian/patches/reproducible-build.patch   2018-02-21 22:28:31.295932059 
+
@@ -0,0 +1,14 @@
+Description: Make the build reproducible
+Author: Chris Lamb 
+Last-Update: 2018-02-21
+
+--- gap-autpgrp-1.5.orig/doc/manual.tex
 gap-autpgrp-1.5/doc/manual.tex
+@@ -35,7 +35,6 @@
+   \centerline{\titlefont A GAP4 Package}\vfill
+   \centerline{\secfont by}\vfill
+   \centerline{\secfont Bettina Eick and Eamonn O'Brien}\vfill
+-  \centerline{\secfont{\Month} \Year}
+ }
+ %
+ %
--- a/debian/patches/series 2018-02-21 22:25:16.586537816 +
--- b/debian/patches/series 2018-02-21 22:28:29.951924809 +
@@ -1,2 +1,3 @@
 doc-makefile
 fix-makedoc
+reproducible-build.patch