Source: snapd
Version: 2.61.1-1
Severity: wishlist

Dear Maintainer,

I'm an occasional volunteer with the Reproducible Builds[1] project, and
recently noticed that the snapd package failed automated reproducible build
testing[2] on Debian.

One cause of non-reproducibility for the package appears to be that the
snap.8 manual page (compressed as snap.8.gz) contains a timestamp in the
header that becomes timezone-localized, meaning that the Debian binary packages
built may vary based on the timezone they're built in.

Although one way to fix this could be to request and display a UTC timestamp,
there's a comment[3] in the debian/rules file that hints at a better solution:
from version 1.4.0-2 of golang-go-flags there is in-built support[4] for the
SOURCE_DATE_EPOCH variable, a time-in-seconds since the Unix epoch (interpreted
in UTC[5]).

That means that it should be possible to generate reproducible manual pages
directly by calling the compiled snap binary with the 'help --man' commandline
arguments, omitting the sed expression as suggested by the comment.

I'll offer a merge request on Salsa to provide that change soon.

Regards,
James

[1] - https://reproducible-builds.org/

[2] - 
https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/snapd.html

[3] - https://sources.debian.org/src/snapd/2.61.1-1/debian/rules/#L281

[4] - https://sources.debian.org/src/golang-go-flags/1.4.0-2/man.go/#L180-L187

[5] - https://pkg.go.dev/time#Unix

Reply via email to