Found 932172 17 Thanks While preparing a stable update for a rust package to fix a FTBFS I discovered that this bug also affects buster, meaning that attempts to update rust packages in buster (e.g. to fix FTBFS introduced by rustc updates) result in rejections.
The fix applies cleanly to the buster package, solves the issue and seems trivial and safe, so so I intend to propose it to the release team as a stable update.
diff -Nru dh-cargo-17/cargo.pm dh-cargo-17+deb10u1/cargo.pm --- dh-cargo-17/cargo.pm 2019-01-24 04:27:14.000000000 +0000 +++ dh-cargo-17+deb10u1/cargo.pm 2021-06-12 14:00:15.000000000 +0000 @@ -175,6 +175,7 @@ sub clean { my $this=shift; + doit("touch", "--no-create", "-d@" . $ENV{SOURCE_DATE_EPOCH}, ".cargo_vcs_info.json"); doit("/usr/share/cargo/bin/cargo", "clean", @_); doit("rm", "-rf", $this->get_sourcepath(".cargo-checksum.json")); doit("rm", "-rf", "debian/cargo_registry"); diff -Nru dh-cargo-17/debian/changelog dh-cargo-17+deb10u1/debian/changelog --- dh-cargo-17/debian/changelog 2019-01-24 09:28:43.000000000 +0000 +++ dh-cargo-17+deb10u1/debian/changelog 2021-06-12 14:04:32.000000000 +0000 @@ -1,3 +1,18 @@ +dh-cargo (17+deb10u1) unstable; urgency=medium + + * Team upload + + [ Gianfranco Costamagna ] + * Apply fix from Ximin Luo to use SOURCE_DATE_EPOCH for the touch command, to + avoid breaking reproducible builds + + [ Dimitri John Ledkov ] + * Touch .cargo_vcs_info.json to update timestamp, as otherwise the file + has unix creation time of 0 which is rejected by the archive in the + .deb.s (Closes: #932172) + + -- Pater Michael Green <plugw...@debian.org> Sat, 12 Jun 2021 14:04:32 +0000 + dh-cargo (17) unstable; urgency=medium * Use --link-from-system from the newer debian-cargo-wrapper.