Bug#827115: netpbm: please honour SOURCE_DATE_EPOCH to allow reproducible output

[Andreas Tille]

Control: tags -1 - patch

Hi,

thanks a lot for your effort to enable reproducible builds, which I
really like to support.  Unfortunately your patch remained unapplied
by the Maintainers of this package.  I recently moved the package to
the Debian Phototools team and try to have a look *from time to time*
(=I do not feel like a responsible Uploader due to time constraints
but I'd volunteer to do team uploads for reasons I consider important
and reproducible builds belong to this.)

I tried to apply your patch to the latest upstream version which I just
uploaded.  Unfortunately every single chunk of the patch is rejected.  I
had a quick look and realised that the code changed in a way that it is
really hard to adapt the patches and I gave up.  I'd happily upload a
package quickly if you could come up with a new patch.  Feel free to
ping me about this.

Kind regards
   Andreas.

-- 
http://fam-tille.de

Bug#827115: netpbm: please honour SOURCE_DATE_EPOCH to allow reproducible output

[Alexis Bienvenüe]

Package: netpbm
Version: 2:10.0-15.3
Severity: wishlist
Tags: patch upstream
User: reproducible-bui...@lists.alioth.debian.org
Usertags: toolchain
X-Debbugs-Cc: reproducible-bui...@lists.alioth.debian.org

Dear Maintainer,

While working on the "reproducible builds" effort [1], we have noticed
that some packages (like latex2html) use one of the netpbm utilities in
their process, leading to unreproducible output (due to the use of the
random generator, seeded from a time() call).

To solve this kind of issues, it would be nice to make netpbm support
the SOURCE_DATE_EPOCH environment variable [2].

See the attached patch for a proposed solution.

Regards,
Alexis Bienvenüe.

[1] https://wiki.debian.org/ReproducibleBuilds
[2] https://reproducible-builds.org/specs/source-date-epoch/


diff -u netpbm-free-10.0/debian/changelog netpbm-free-10.0/debian/changelog
--- netpbm-free-10.0/debian/changelog
+++ netpbm-free-10.0/debian/changelog
@@ -1,3 +1,9 @@
+netpbm-free (2:10.0-15.3.0~reproducible1) UNRELEASED; urgency=medium
+
+  * SOURCE_DATE_EPOCH support.
+
+ -- Alexis Bienvenüe   Sun, 12 Jun 2016 11:43:19 +0200
+
 netpbm-free (2:10.0-15.3) unstable; urgency=medium
 
   * Non-maintainer upload.
only in patch2:
unchanged:
--- netpbm-free-10.0.orig/include/pm.h
+++ netpbm-free-10.0/include/pm.h
@@ -20,6 +20,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #ifdef VMS
 #include 
@@ -245,5 +246,10 @@
 char *
 pm_arg0toprogname(const char arg0[]);
 
+/* SOURCE_DATE_EPOCH support */
+
+time_t
+pm_source_time(int use_pid);
+
 #endif
 
only in patch2:
unchanged:
--- netpbm-free-10.0.orig/pbm/libpm.c
+++ netpbm-free-10.0/pbm/libpm.c
@@ -23,6 +23,9 @@
 #include 
 #include 
 #include 
+#include 
+#include 
+#include 
 
 /* The following are set by pm_init(), then used by subsequent calls to other
pm_xxx() functions.
@@ -938,3 +941,42 @@
 	return realloc(a, b*c);
 }
 
+time_t pm_source_time(int use_pid)
+{
+  time_t now;
+  char *source_date_epoch;
+  unsigned long long epoch;
+  char *endptr;
+
+  source_date_epoch = getenv("SOURCE_DATE_EPOCH");
+  if (source_date_epoch) {
+errno = 0;
+epoch = strtoull(source_date_epoch, , 10);
+if ((errno == ERANGE && (epoch == ULLONG_MAX || epoch == 0))
+|| (errno != 0 && epoch == 0)) {
+  fprintf(stderr, "Environment variable $SOURCE_DATE_EPOCH: strtoull: %s\n", strerror(errno));
+  exit(EXIT_FAILURE);
+}
+if (endptr == source_date_epoch) {
+  fprintf(stderr, "Environment variable $SOURCE_DATE_EPOCH: No digits were found: %s\n", endptr);
+  exit(EXIT_FAILURE);
+}
+if (*endptr != '\0') {
+  fprintf(stderr, "Environment variable $SOURCE_DATE_EPOCH: Trailing garbage: %s\n", endptr);
+  exit(EXIT_FAILURE);
+}
+if (epoch > ULONG_MAX) {
+  fprintf(stderr, "Environment variable $SOURCE_DATE_EPOCH: value must be smaller than or equal to: %lu but was found to be: %llu \n", ULONG_MAX, epoch);
+  exit(EXIT_FAILURE);
+}
+now = epoch;
+return(now);
+  } else {
+now = time(NULL);
+if(use_pid) {
+  return(now ^ getpid());
+} else {
+  return(now);
+}
+  }
+}
only in patch2:
unchanged:
--- netpbm-free-10.0.orig/pbm/pbmreduce.c
+++ netpbm-free-10.0/pbm/pbmreduce.c
@@ -98,7 +98,7 @@
 if ( thiserr == 0 || nexterr == 0 )
   pm_error( "out of memory" );
 
-srand( (int) ( time( 0 ) ^ getpid( ) ) );
+srand( (int) ( pm_source_time(1) ) );
 for ( col = 0; col < newcols + 2; ++col )
   thiserr[col] = ( rand( ) % SCALE - HALFSCALE ) / 4;
 	/* (random errors in [-SCALE/8 .. SCALE/8]) */
only in patch2:
unchanged:
--- netpbm-free-10.0.orig/pgm/pgmcrater.c
+++ netpbm-free-10.0/pgm/pgmcrater.c
@@ -107,7 +107,7 @@
 {
 int i;
 
-i = time((long *) 0) * 0xF37C;
+i = pm_source_time(0) * 0xF37C;
 srand(i);
 for (i = 0; i < 7; i++) {
 	V rand();
only in patch2:
unchanged:
--- netpbm-free-10.0.orig/pgm/pgmnoise.c
+++ netpbm-free-10.0/pgm/pgmnoise.c
@@ -57,7 +57,7 @@
 	pgm_writepgminit(stdout, cols, rows, PGM_MAXMAXVAL, 0);
 
 	/* get time of day to feed the random number generator */
-	timenow = time(NULL);
+	timenow = pm_source_time(0);
 	srand(timenow);
 
 	/* create the (gray) noise */
only in patch2:
unchanged:
--- netpbm-free-10.0.orig/pgm/pgmtopbm.c
+++ netpbm-free-10.0/pgm/pgmtopbm.c
@@ -132,7 +132,7 @@
 	overflow_add(cols, 2);
 	thiserr = (long*) pm_allocrow( cols + 2, sizeof(long) );
 	nexterr = (long*) pm_allocrow( cols + 2, sizeof(long) );
-	srand( (int) ( time( 0 ) ^ getpid( ) ) );
+	srand( (int) ( pm_source_time(1) ) );
 	for ( col = 0; col < cols + 2; ++col )
 		thiserr[col] = ( rand( ) % FS_SCALE - HALF_FS_SCALE ) / 4;
 	/* (random errors in [-FS_SCALE/8 .. FS_SCALE/8]) */
only in patch2:
unchanged:
--- netpbm-free-10.0.orig/pnm/pnmremap.c
+++ netpbm-free-10.0/pnm/pnmremap.c
@@ -243,7 +243,7 @@
 pm_error("Out of memory allocating Floyd-Steinberg structures");
 }