Source: extrepo-data Severity: normal Tags: patch User: reproducible-bui...@lists.alioth.debian.org Usertags: timestamps X-Debbugs-Cc: reproducible-b...@lists.alioth.debian.org, distro-i...@packages.debian.org
It seems extrepo-data embeds different repository information depending on when it is built, inferring the resolution of the "testing" suite to a specific named released based on the current date (e.g. bookworm vs. trixie). https://tests.reproducible-builds.org/debian/rb-pkg/bookworm/amd64/diffoscope-results/extrepo-data.html usr/share/extrepo/offline-data/debian/trixie/consol.asc vs. usr/share/extrepo/offline-data/debian/bookworm/consol.asc This is because extrepo-data calls DebianDistroInfo->new() from libdistro-info-perl: tools/lib/ExtRepoData.pm:my $info = DebianDistroInfo->new(); Which resolves testing to a suite based on the current date. The attached patch works around this by explicitly passing the codenames instead of the "testing" suite, though I am not sure the specified repositories actually exist, so should require further verification before applying. There may be similar issues with using "stable" suites as well, though I have not found any examples at the moment. There are likely better ways to resolve this issue (e.g. adding SOURCE_DATE_EPOCH support to libdistro-info-perl), though hopefully someone with a bit more perl skills can tackle that. Specifying suites explicitly might be better than relying on a "testing" suite that may change codename regardless of weather libdistro-info-perl is fixed anyways. (e.g. a security or stable or oldstable update might result in a package with totally with different respositories). With this patch applied, extrepo-data should build reproducibly on tests.reproducible-builds.org! Thanks for maintaining extrepo-data! live well, vagrant
From eccf2ad7e59696bd9c2dd4f1db58ab15ef628968 Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagr...@reproducible-builds.org>
Date: Sat, 24 Sep 2022 19:19:52 +0000
Subject: [PATCH] Avoid using "testing" which produces different results
depending on the current date.
This is because extrepo-data uses DebianDistroInfo->new() from
libdistro-info-perl, which does not appear to provide the ability to
pass a desired time, or respect SOURCE_DATE_EPOCH.
---
repos/debian/consol.yaml | 3 ++-
repos/debian/feistermops.yaml | 4 +++-
repos/debian/janitor.yaml | 2 +-
3 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/repos/debian/consol.yaml b/repos/debian/consol.yaml
index dd26d83..65a81ac 100644
--- a/repos/debian/consol.yaml
+++ b/repos/debian/consol.yaml
@@ -10,7 +10,8 @@ consol:
suites:
- buster
- bullseye
- - testing
+ - bookworm
+ - trixie
- unstable
policy: main
gpg-key: |
diff --git a/repos/debian/feistermops.yaml b/repos/debian/feistermops.yaml
index c2a96ce..a9b43c8 100644
--- a/repos/debian/feistermops.yaml
+++ b/repos/debian/feistermops.yaml
@@ -17,7 +17,9 @@
"jessie",
"sid",
"stretch",
- "testing",
+ "bullseye",
+ "bookworm",
+ "trixie",
"wheezy"
]
}
diff --git a/repos/debian/janitor.yaml b/repos/debian/janitor.yaml
index 1259be4..644ec66 100644
--- a/repos/debian/janitor.yaml
+++ b/repos/debian/janitor.yaml
@@ -13,7 +13,7 @@ janitor:
- sid
- bookworm
- unstable
- - testing
+ - trixie
policy: main
--
2.30.2
signature.asc
Description: PGP signature
