Bug#978499: marked as done (fop: reproducible builds: Support using SOURCE_DATE_EPOCH for timestamps in PDF files)
Your message dated Thu, 31 Dec 2020 20:33:44 + with message-id and subject line Bug#978499: fixed in fop 1:2.5-3 has caused the Debian Bug report #978499, regarding fop: reproducible builds: Support using SOURCE_DATE_EPOCH for timestamps in PDF files to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 978499: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978499 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems --- Begin Message --- Package: fop Severity: normal Tags: patch User: reproducible-bui...@lists.alioth.debian.org Usertags: timestamps toolchain X-Debbugs-Cc: reproducible-b...@lists.alioth.debian.org Several packages use fop to generate PDF files in Debian packages, but the resulting PDF files have embedding timestamp information in the CreationDate of the PDF: https://tests.reproducible-builds.org/debian/issues/unstable/timestamps_in_pdf_generated_by_apache_fop_issue.html For example, in xorg-docs: https://tests.reproducible-builds.org/debian/rb-pkg/bullseye/amd64/diffoscope-results/xorg-docs.html /usr/share/doc/xorg-docs/xlfd/xlfd.pdf.gz CreationDate:·"D:20201225182038-12'00'" vs. CreationDate:·"D:20220129025203+14'00'" The attached patch fixes this by adding support for the SOURCE_DATE_EPOCH environment variable to fop, which embeds the specified timestamp rather than the current time: https://reproducible-builds.org/docs/source-date-epoch/ Thanks for maintaining fop! live well, vagrant From 25826ea9c86d01a8392cf593b9aa93c72b469b19 Mon Sep 17 00:00:00 2001 From: Vagrant Cascadian Date: Mon, 28 Dec 2020 02:48:21 + Subject: [PATCH] PDFInfo.java: Support SOURCE_DATE_EPOCH environment variable. https://reproducible-builds.org/docs/source-date-epoch/ --- fop-core/src/main/java/org/apache/fop/pdf/PDFInfo.java | 9 - 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/fop-core/src/main/java/org/apache/fop/pdf/PDFInfo.java b/fop-core/src/main/java/org/apache/fop/pdf/PDFInfo.java index 3aa5d97..79f3f42 100644 --- a/fop-core/src/main/java/org/apache/fop/pdf/PDFInfo.java +++ b/fop-core/src/main/java/org/apache/fop/pdf/PDFInfo.java @@ -305,7 +305,14 @@ public class PDFInfo extends PDFObject { * @return the requested String representation */ protected static String formatDateTime(final Date time) { -return formatDateTime(time, TimeZone.getDefault()); +// https://reproducible-builds.org/docs/source-date-epoch/ +String source_date_epoch = System.getenv("SOURCE_DATE_EPOCH"); +if (source_date_epoch != null) { +Long sourcedate = (1000 * Long.parseLong(source_date_epoch)); +return formatDateTime(new Date(sourcedate), TimeZone.getTimeZone("Etc/UTC")); +} else { +return formatDateTime(time, TimeZone.getDefault()); +} } /** -- 2.20.1 signature.asc Description: PGP signature --- End Message --- --- Begin Message --- Source: fop Source-Version: 1:2.5-3 Done: tony mancill We believe that the bug you reported is fixed in the latest version of fop, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 978...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. tony mancill (supplier of updated fop package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@ftp-master.debian.org) -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Thu, 31 Dec 2020 11:24:15 -0800 Source: fop Architecture: source Version: 1:2.5-3 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers Changed-By: tony mancill Closes: 978499 Changes: fop (1:2.5-3) unstable; urgency=medium . * Team upload * Update SOURCE_DATE_EPOCH patch (Closes: #978499) - Conditionally use SOURCE_DATA_EPOCH in PDFInfo, PDFMetadata, PDFRenderingUtil, and FileIDGenerator classes. - Add try/catch logic for unparsable SOURCE_DATE_EPOCH Checksums-Sha1: 6c0d7b2a53925ae258cb52b6f7bd93440df4386b 2609 fop_2.5-3.dsc 70db744862904cbea3b06bb6b0a4f2373b8a89db 873596 fop_2.5-3.debian.tar.xz 5835a83c20010debb44e333aba90943581837811 13663 fop_2.5-3_amd64.buildinfo Checksums-Sha256: 7efd4de14cd7fadc44fd3c1af50df90511264886a24b5e7fb1d3142053c42fc6 2609 fop_2.5-3.dsc
Bug#978499: marked as done (fop: reproducible builds: Support using SOURCE_DATE_EPOCH for timestamps in PDF files)
Your message dated Tue, 29 Dec 2020 01:49:09 + with message-id and subject line Bug#978499: fixed in fop 1:2.5-2 has caused the Debian Bug report #978499, regarding fop: reproducible builds: Support using SOURCE_DATE_EPOCH for timestamps in PDF files to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 978499: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978499 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems --- Begin Message --- Package: fop Severity: normal Tags: patch User: reproducible-bui...@lists.alioth.debian.org Usertags: timestamps toolchain X-Debbugs-Cc: reproducible-b...@lists.alioth.debian.org Several packages use fop to generate PDF files in Debian packages, but the resulting PDF files have embedding timestamp information in the CreationDate of the PDF: https://tests.reproducible-builds.org/debian/issues/unstable/timestamps_in_pdf_generated_by_apache_fop_issue.html For example, in xorg-docs: https://tests.reproducible-builds.org/debian/rb-pkg/bullseye/amd64/diffoscope-results/xorg-docs.html /usr/share/doc/xorg-docs/xlfd/xlfd.pdf.gz CreationDate:·"D:20201225182038-12'00'" vs. CreationDate:·"D:20220129025203+14'00'" The attached patch fixes this by adding support for the SOURCE_DATE_EPOCH environment variable to fop, which embeds the specified timestamp rather than the current time: https://reproducible-builds.org/docs/source-date-epoch/ Thanks for maintaining fop! live well, vagrant From 25826ea9c86d01a8392cf593b9aa93c72b469b19 Mon Sep 17 00:00:00 2001 From: Vagrant Cascadian Date: Mon, 28 Dec 2020 02:48:21 + Subject: [PATCH] PDFInfo.java: Support SOURCE_DATE_EPOCH environment variable. https://reproducible-builds.org/docs/source-date-epoch/ --- fop-core/src/main/java/org/apache/fop/pdf/PDFInfo.java | 9 - 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/fop-core/src/main/java/org/apache/fop/pdf/PDFInfo.java b/fop-core/src/main/java/org/apache/fop/pdf/PDFInfo.java index 3aa5d97..79f3f42 100644 --- a/fop-core/src/main/java/org/apache/fop/pdf/PDFInfo.java +++ b/fop-core/src/main/java/org/apache/fop/pdf/PDFInfo.java @@ -305,7 +305,14 @@ public class PDFInfo extends PDFObject { * @return the requested String representation */ protected static String formatDateTime(final Date time) { -return formatDateTime(time, TimeZone.getDefault()); +// https://reproducible-builds.org/docs/source-date-epoch/ +String source_date_epoch = System.getenv("SOURCE_DATE_EPOCH"); +if (source_date_epoch != null) { +Long sourcedate = (1000 * Long.parseLong(source_date_epoch)); +return formatDateTime(new Date(sourcedate), TimeZone.getTimeZone("Etc/UTC")); +} else { +return formatDateTime(time, TimeZone.getDefault()); +} } /** -- 2.20.1 signature.asc Description: PGP signature --- End Message --- --- Begin Message --- Source: fop Source-Version: 1:2.5-2 Done: tony mancill We believe that the bug you reported is fixed in the latest version of fop, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 978...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. tony mancill (supplier of updated fop package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@ftp-master.debian.org) -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Mon, 28 Dec 2020 11:42:20 -0800 Source: fop Architecture: source Version: 1:2.5-2 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers Changed-By: tony mancill Closes: 978499 Changes: fop (1:2.5-2) unstable; urgency=medium . * Team upload * Use SOURCE_DATE_EPOCH from system environment (Closes: #978499) For reproducible builds of packages that use fop as a build-dep. * Remove deprecated get-orig-source target * Update debian/watch to version 4 * Bump Standards-Version to 4.5.1 * Set Rules-Requires-Root: no in debian/control * Use debhelper-compat 13 Checksums-Sha1: d968e1726e911fcf64f60cdcdff1b8bcfecc4c3d 2609 fop_2.5-2.dsc 7fc9a28b24bfbc47b3d92323863fc1f3df12c41e 872680 fop_2.5-2.debian.tar.xz 8711780cff10e8078d33b386bfce8da9602beaca 13562 fop_2.5-2_amd64.buildinfo