Holger Levsen dijo [Wed, Mar 16, 2016 at 01:20:29PM -0400]: > Hi Gunnar, > > in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=818111#10 you > wrote: > > > However, even with this, the package is *not yet* built reproducibly: > > There is still a source of noise for the source package creation > > step. > > I'm not sure you ment this(?) but it's a known (+sad) fact, that we > cannot create reproducible source packages yet. So don't bother about > this yet. Or did you mean something else?
Sorry, I got mixed up WRT some details, as I was writing from memory. What I have now is: debian-keyring$ gbp buildpackage -us -uc (...) debian-keyring$ mkdir ../build-area/old debian-keyring$ mv ../build-area/debian-keyring_2016.03.xx* ../build-area/old/ debian-keyring$ gbp buildpackage -us -uc (...) debian-keyring$ diffoscope ../build-area/old/debian-keyring_2016.03.xx_amd64.changes ../build-area/debian-keyring_2016.03.xx_amd64.changes --- ../build-area/old/debian-keyring_2016.03.xx_amd64.changes +++ ../build-area/debian-keyring_2016.03.xx_amd64.changes ├── Files │ @@ -1,4 +1,4 @@ │ │ 85c889d4df09fb2b69296bd6611c7d48 854 misc optional debian-keyring_2016.03.xx.dsc │ bc61ceaab56033822641295d4a1737a8 40196984 misc optional debian-keyring_2016.03.xx.tar.xz │ - f6c07a45828b1ed14272262e8e8ef0e1 33128510 misc optional debian-keyring_2016.03.xx_all.deb │ + cca0ea09e711f77572a0079add65975e 33128510 misc optional debian-keyring_2016.03.xx_all.deb ├── debian-keyring_2016.03.xx_all.deb │ ├── file list │ │ @@ -1,3 +1,3 @@ │ │ --rw-r--r-- 0 0 0 4 2016-03-17 17:35:13.000000 debian-binary │ │ --rw-r--r-- 0 0 0 834 2016-03-17 17:35:13.000000 control.tar.gz │ │ --rw-r--r-- 0 0 0 33127484 2016-03-17 17:35:25.000000 data.tar.xz │ │ +-rw-r--r-- 0 0 0 4 2016-03-17 17:36:29.000000 debian-binary │ │ +-rw-r--r-- 0 0 0 834 2016-03-17 17:36:29.000000 control.tar.gz │ │ +-rw-r--r-- 0 0 0 33127484 2016-03-17 17:36:40.000000 data.tar.xz │ ╵ ╵ So, no, it's not the source package, but the creation date of the in-cpio tar.[xg]z files, which seems to be the result of our call to 'dpkg --build debian/tmp ..' in debian/rules. So, no, not source-package related. Sorry for the noise! :-( > > Maybe the answer would be to stop hand-building everything and > > update our packaging format to dh-based or something like that? > > I think you should do this anyway. dh9 totally rocks :) I totally agree with you on this :)
