Bug#1020715:
A correction for a mistake in my previous message: > Because Debian builds packages from a fixed build path, neither the > 'reprotest' > utility in Salsa-CI, nor the Reproducible Builds team's package test > infrastructure for Debian[1] currently check for equivalent binary package > output from differing source package build paths. > > This means that your package will pass current reproducibility tests; ... > [ snip ] Currently the 'reprotest' job in Salsa-CI does in fact continue to exercise variations of the build-path, and will fail if it builds binary packages that contain different contents as a result.
Bug#1020715:
Control: severity -1 wishlist Dear Maintainer, Because Debian builds packages from a fixed build path, neither the 'reprotest' utility in Salsa-CI, nor the Reproducible Builds team's package test infrastructure for Debian[1] currently check for equivalent binary package output from differing source package build paths. This means that your package will pass current reproducibility tests; however we believe that source code and/or build steps still embed the build path into the binary package output, making it more difficult than necessary for independent consumers to check the integrity of those packages by rebuilding them themselves. As a result, this bugreport will remain open and be re-assigned the 'wishlist' severity[2]. For more information about build paths and how they can affect reproducibility, please refer to: https://reproducible-builds.org/docs/build-path/ Thanks, James [1] - https://tests.reproducible-builds.org/debian/reproducible.html [2] - https://www.debian.org/Bugs/Developer#severities
Bug#1020715: xserver-xorg-input-joystick: reproducible-builds: Embedded build path in joystick_drv.so
Source: xserver-xorg-input-joystick Severity: normal Tags: patch User: reproducible-bui...@lists.alioth.debian.org Usertags: buildpath X-Debbugs-Cc: reproducible-b...@lists.alioth.debian.org The build path is embedded in /usr/lib/xorg/modules/input/joystick_drv.so: https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/xserver-xorg-input-joystick.html /build/1st/xserver-xorg-input-joystick-1.6.3/build/src/../../src/jstk.c:298 vs. /build/2/xserver-xorg-input-joystick-1.6.3/2nd/build/src/../../src/jstk.c:298 The attached patch fixes this in debian/rules by passing -ffile-prefix-map in CFLAGS to configure. With this patch applied xserver-xorg-input-joystick should build reproducibly on tests.reproducible-builds.org! Thanks for maintaining xserver-xorg-input-joystick! live well, vagrant From 3810247bbd3d038b4d8ac21016d43ca809a8f0b9 Mon Sep 17 00:00:00 2001 From: Vagrant Cascadian Date: Sun, 25 Sep 2022 18:17:21 + Subject: [PATCH] debian/rules: Pass CFLAGS to dh_auto_configure, and include -ffile-prefix-map to avoid embedding build path. https://reproducible-builds.org/docs/build-path/ --- debian/rules | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/rules b/debian/rules index c721608..9e13de7 100755 --- a/debian/rules +++ b/debian/rules @@ -1,7 +1,7 @@ #!/usr/bin/make -f override_dh_auto_configure: - dh_auto_configure -- --disable-silent-rules + dh_auto_configure -- --disable-silent-rules CFLAGS="$(CFLAGS) -ffile-prefix-map=$(CURDIR)=." # Install in debian/tmp to retain control through dh_install: override_dh_auto_install: -- 2.37.2 signature.asc Description: PGP signature
