Hi Bastian, * Chris Lamb <[email protected]> [2021-03-16 09:19]:
Source: cdebootstrap Version: 0.7.8 Severity: wishlist Tags: patch User: [email protected] Usertags: filesystem X-Debbugs-Cc: [email protected]Hi, Whilst working on the Reproducible Builds effort [0] we noticed that cdebootstrap could not be built reproducibly. This is the because the embedded .tar file does not sort its entries so it inherits the (non-deterministic) filesystem ordering. Patch attached that adds --sort=name (next to --mtime=[..]) that makes the build reproducible for me locally. [0] https://reproducible-builds.org/ Regards, -- ,''`. : :' : Chris Lamb `. `'` [email protected] / chris-lamb.co.uk `-
--- a/debian/rules 2021-03-16 08:54:17.949083106 +0000
--- b/debian/rules 2021-03-16 08:58:39.291962035 +0000
@@ -38,7 +38,7 @@
dh_auto_install --builddir build-tar --destdir debian/tmp
strip --remove-section=.comment --remove-section=.note
debian/tmp/usr/bin/cdebootstrap
- tar -C debian/tmp/usr/bin --mtime=@$(SOURCE_DATE_EPOCH) -cf
debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar .
+ tar -C debian/tmp/usr/bin --sort=name --mtime=@$(SOURCE_DATE_EPOCH) -cf
debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar .
mkdir -p debian/cdebootstrap-static/usr/lib/cdebootstrap
cp debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar
debian/cdebootstrap-static/usr/lib/cdebootstrap
I have just tested this and it makes the package reproducible for me. Is there anything blocking the integration of this?
Cheers Jochen
signature.asc
Description: PGP signature
