Source: refpolicy
Version: 2:2.20221101-4
Severity: normal
Tags: patch
User: reproducible-bui...@lists.alioth.debian.org
Usertags: username
X-Debbugs-Cc: reproducible-b...@lists.alioth.debian.org

The source tarball /usr/src/selinux-policy-src.tar.zst embeds the
username, userid, groupname and groupid of the build user:

  
https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/refpolicy.html

  
drwxr-xr-x···0·pbuilder1··(1111)·pbuilder1··(1111)········0·2023-01-29·04:07:05.000000·selinux-policy-src/
  vs.
  
drwxr-xr-x···0·pbuilder2··(2222)·pbuilder2··(2222)········0·2023-01-29·04:07:05.000000·selinux-policy-src/

The attached patch fixes this by passing arguments to tar in
debian/rules to ensure consistent user, group, uid and gid in the
generated tarball.

Historically, most versions of refpolicy did not have this issue, so
this appears to be a recent regression (possibly triggered by a switch
to "rules-requires-root: no"?):

  https://tests.reproducible-builds.org/debian/history/refpolicy.html

According to my local tests, with this patch applied refpolicy should
become reproducible on tests.reproducible-builds.org!

Thanks for maintaining refpolicy!

live well,
  vagrant
From 7b691da36a702d912cfd647f50cdeed5ca7bd0c6 Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagr...@reproducible-builds.org>
Date: Mon, 30 Jan 2023 19:49:41 +0000
Subject: [PATCH] debian/rules: Pass arguments to tar to use a consistent uid
 and gid.

Otherwise the user name, user id, group name and group id are recorded
in selinux-policy-src.tar.zst shipped in the package.

https://reproducible-builds.org/docs/archives/
---
 debian/rules | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/debian/rules b/debian/rules
index 32d70d6..d7feee3 100755
--- a/debian/rules
+++ b/debian/rules
@@ -166,6 +166,6 @@ install-src: conf-src
 	  rm -rf selinux-policy-src/support/__pycache__/; \
 	  find selinux-policy-src -type f -print0 | xargs -0r chmod 0644; \
 	  find selinux-policy-src -type d -print0 | xargs -0r chmod 0755; \
-	  TZ=UTC tar cf - --sort=name --mtime="$(BUILD_DATE)" selinux-policy-src | zstd -9 > $(CURDIR)/debian/tmp/usr/src/selinux-policy-src.tar.zst)
+	  TZ=UTC tar cf - --sort=name --mtime="$(BUILD_DATE)" --owner=0 --group=0 --numeric-owner selinux-policy-src | zstd -9 > $(CURDIR)/debian/tmp/usr/src/selinux-policy-src.tar.zst)
 	rm -rf               $(CURDIR)/debian/tmp/etc/selinux/default/src/
 	touch $@
-- 
2.30.2

Attachment: signature.asc
Description: PGP signature

Reply via email to