Bug#994979: python-tomli: please make the build reproducible

[James Addison]

Source: python-tomli
Followup-For: Bug #994979
X-Debbugs-Cc: j...@jp-hosting.net

I'm reasonably confident that this bug can now be closed.  From some digging 
around earlier today:

- The dh-python update mentioned by Stefano addressed the direct_url.json build 
reproducibility issue

- Despite a recent reproducible build test failure[1] for arm64 on 2022-11-22, 
the underlying cause has been addressed separately[2] in #1024521

[1] - 
https://tests.reproducible-builds.org/debian/rb-pkg/unstable/arm64/diffoscope-results/python-tomli.html

[2] - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1024521

Bug#994979: python-tomli: please make the build reproducible

[Stefano Rivera]

FYI, this will be fixed in the next dh-python upload: 
https://salsa.debian.org/python-team/tools/dh-python/-/commit/2ef6ff13748984258d5da000c17d9cdad707b9ae

SR

-- 
Stefano Rivera
  http://tumbleweed.org.za/
  +1 415 683 3272

Bug#994979: python-tomli: please make the build reproducible

[Chris Lamb]

Source: python-tomli
Version: 1.2.1-1
Severity: wishlist
Tags: patch
User: reproducible-bui...@lists.alioth.debian.org
Usertags: buildpath
X-Debbugs-Cc: reproducible-b...@lists.alioth.debian.org

Hi,

Whilst working on the Reproducible Builds effort [0] we noticed that
python-tomli could not be built reproducibly.

Although you do remove the direct_url.json file, you don't remove the
entry for this file in RECORD, which itself contains a (varying)
checksum of the deleted file:

│ │ │ ├── ./usr/lib/python3/dist-packages/tomli-1.2.1.dist-info/RECORD
│ │ │ │ @@ -1,11 +1,11 @@
│ │ │ │  
tomli-1.2.1.dist-info/INSTALLER,sha256=91a475e3f8891fc45b7eb71b7c504ae3b86ae04524763ab0e91f97f6f8df,4
│ │ │ │  
tomli-1.2.1.dist-info/METADATA,sha256=5bb89bfb29298d4bfead3130c509405707a6aa8f272fdea4ee50017e4cdec6b7,9101
│ │ │ │  
tomli-1.2.1.dist-info/REQUESTED,sha256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855,0
│ │ │ │ 
-tomli-1.2.1.dist-info/direct_url.json,sha256=396aed5a19336eada50c0cb59d7704f1954f0ab940aadb48d90e260e08193720,80
│ │ │ │ 
+tomli-1.2.1.dist-info/direct_url.json,sha256=08b7d1db6996f039520de8ade13c939dd7ca5844c89b7b0a2ae1834e5f31841c,82
│ │ │ │  
tomli/__init__.py,sha256=3856fb59e76aac482a9fa67b1de9be2725929263695190956d55669b7633bc03,218
│ │ │ │  tomli/__pycache__/__init__.cpython-39.pyc,,
│ │ │ │  tomli/__pycache__/_parser.cpython-39.pyc,,
│ │ │ │  tomli/__pycache__/_re.cpython-39.pyc,,
│ │ │ │  
tomli/_parser.py,sha256=fe11bcfd620df735b03d56150f4a9c6090b8f461bde750878dfe21b872238fc5,21638
│ │ │ │  
tomli/_re.py,sha256=2e395f2b0b1f98b2ed8988571265dc513eafb30b88d30422531eafd4868edd1a,2855
│ │ │ │  
tomli/py.typed,sha256=f0f8f2675695a10a5156fb7bd66bafbaae6a13e8d315990af862c792175e6e67,26

Patch attached that removes the relevant line from this file. However,
I wonder if the whole thing might get fixed by [1], so please don't
rush to apply this. (I will post a message to that MR after filing
this bug).

 [0] https://reproducible-builds.org/
 [1] https://salsa.debian.org/python-team/tools/dh-python/-/merge_requests/17


Regards,

--
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org / chris-lamb.co.uk
   `-

--- a/debian/rules  2021-09-24 09:50:38.945664313 +0100
--- b/debian/rules  2021-09-24 10:00:52.032895019 +0100
@@ -5,7 +5,7 @@
 export PYBUILD_SYSTEM=flit
 export PYBUILD_TEST_PYTEST=1
 export PYBUILD_TEST_ARGS=python{version} -m pytest -n auto -k "not 
test_own_pyproject"
-export PYBUILD_AFTER_INSTALL=rm 
{destdir}/usr/lib/python{version}/dist-packages/tomli-*dist-info/direct_url.json
+export PYBUILD_AFTER_INSTALL=rm 
{destdir}/usr/lib/python{version}/dist-packages/tomli-*dist-info/direct_url.json;
 sed -i '/direct_url.json/d' 
{destdir}/usr/lib/python{version}/dist-packages/tomli-*dist-info/RECORD
 # ^ is due to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=969352
 
 %: