Your message dated Tue, 13 Jun 2023 04:05:27 +0000
with message-id <e1q8vhb-001uvc...@fasolo.debian.org>
and subject line Bug#1035405: fixed in bnd 5.0.1-4
has caused the Debian Bug report #1035405,
regarding bnd: reproducible-builds: build timestamps in files inside of .jar
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
1035405: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1035405
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: bnd
Severity: normal
Tags: patch
User: reproducible-bui...@lists.alioth.debian.org
Usertags: timestamps timezone
X-Debbugs-Cc: reproducible-b...@lists.alioth.debian.org
The build timestamp is embedded inside a jar embedded inside
/usr/share/java/bnd-5.0.1.jar:
https://tests.reproducible-builds.org/debian/rb-pkg/bookworm/amd64/diffoscope-results/bnd.html
embedded-repo.jar
Timestamp:·1715504316639\xd
vs.
Timestamp:·1681094408754\xd
The attached patch fixes this from debian/rules by replacing the
Timestamp field with SOURCE_DATE_EPOCH.
Alternately, a better fix might be to figure out exactly where the
${_@tstamp} value is derived from, and add SOURCE_DATE_EPOCH support to
that. There are various functions throughout the codebase that affect
TSTAMP, _tstamp and _@tstamp, but I could not find the right one to fix
this particular issue. In debian/patches there are a few which
presumably fix other issues by adding SOURCE_DATE_EPOCH support.
According to my local tests, with this patch applied, bnd should build
reproducibly on tests.reproducible-builds.org!
Thanks for maintaining bnd!
live well,
vagrant
From c8c6878d524525062c7637e3215ac2758f3885aa Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagr...@reproducible-builds.org>
Date: Tue, 2 May 2023 16:27:07 -0700
Subject: [PATCH] debian/rules: Override the timestamp used in embedded.bnd
with SOURCE_DATE_EPOCH.
https://reproducible-builds.org/docs/source-date-epoch/
---
debian/rules | 3 +++
1 file changed, 3 insertions(+)
diff --git a/debian/rules b/debian/rules
index 17eca1c..3243b3b 100755
--- a/debian/rules
+++ b/debian/rules
@@ -82,6 +82,9 @@ override_dh_auto_build:
ln -s /usr/share/java/snakeyaml.jar cnf/cache/$(VERSION)/bnd-cache/org.yaml.snakeyaml/org.yaml.snakeyaml-latest.jar
ln -s /usr/share/java/xz.jar cnf/cache/$(VERSION)/bnd-cache/org.tukaani.xz/org.tukaani.xz-latest.jar
$(RM) -r biz.aQute.repository/src/aQute/bnd/jpm # This package depends on non-free code
+
+ # Use SOURCE_DATE_EPOCH for the timestamp
+ sed -i -e "s,Timestamp:.*,Timestamp: $(SOURCE_DATE_EPOCH),g" biz.aQute.bnd.embedded-repo/bnd/embedded-repo.bnd
dh_auto_build -- :biz.aQute.bnd:assemble \
:biz.aQute.launcher:assemble \
:biz.aQute.junit:assemble \
--
2.39.2
signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
Source: bnd
Source-Version: 5.0.1-4
Done: tony mancill <tmanc...@debian.org>
We believe that the bug you reported is fixed in the latest version of
bnd, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1035...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
tony mancill <tmanc...@debian.org> (supplier of updated bnd package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 12 Jun 2023 20:26:25 -0700
Source: bnd
Architecture: source
Version: 5.0.1-4
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers
<pkg-java-maintain...@lists.alioth.debian.org>
Changed-By: tony mancill <tmanc...@debian.org>
Closes: 1035405
Changes:
bnd (5.0.1-4) unstable; urgency=medium
.
* Team upload
.
[ Emmanuel Bourg ]
* Updated the watch file
.
[ 殷啟聰 | Kai-Chung Yan ]
* Remove myself from Uploaders
.
[ tony mancill ]
* Reproducible build timestamp (Closes: #1035405)
Thank you to Vagrant Cascadian for the patch.
* Bump Standards-Version to 4.6.2
* Add missing Apache NOTICE file
* Set Rules-Requires-Root: no in debian/control
Checksums-Sha1:
aff3c5c3b04ae3d923e310f7f3bc5a90c56c4168 2397 bnd_5.0.1-4.dsc
d54f2f7f13718531bafb8e1c5bb2417c1aa0d85f 30412 bnd_5.0.1-4.debian.tar.xz
566f522b2923fdd7a43a546297db5637ca94ed7a 15749 bnd_5.0.1-4_amd64.buildinfo
Checksums-Sha256:
da82be6d1055e9ff16d63c5f074c1bb9f31a8ed314eddd4b8c46ff8790b0a903 2397
bnd_5.0.1-4.dsc
01a3d6ab7636bbe1d5150e0b3f611fcecf03abaab2d507234adc3a93496c1475 30412
bnd_5.0.1-4.debian.tar.xz
50a06fa0455fd515dbdfb3e344321bfbb6bb73be27e8c74aef5ed91ee9b9a5cd 15749
bnd_5.0.1-4_amd64.buildinfo
Files:
7604a500440c8df5da1c3d06f6834254 2397 java optional bnd_5.0.1-4.dsc
ca7e2397b72bc5dc42f1d4cf32703c5d 30412 java optional bnd_5.0.1-4.debian.tar.xz
902f722b10fea65438279a1a55cb62d1 15749 java optional
bnd_5.0.1-4_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCgAyFiEE5Qr9Va3SequXFjqLIdIFiZdLPpYFAmSH5J0UHHRtYW5jaWxs
QGRlYmlhbi5vcmcACgkQIdIFiZdLPpZMzA//SpSVi8v25R9rmodRArerF2udhCkm
HIEsb9b/UYfLed5lZ3MCEvpO3NSzpUMMZ/on+bs7oN+WqiyxQ+zR5wL4Plagp5r2
8byUyJmJ4TI9xWzhKtopsnUsaHgpjT3Vn+Rtqk/q/lbBy4/VK056se9sKdSepMDq
Ho1Unl/ebwrH86TuuxcKn8fpUWYYD9xiblYzNh48xAI9AWjFBlphDqJhDyafkq8I
fIksl2VCi80APNv9YFi9P5qEjPxVFbn+T4dcmAimCjgdaRUGdhPst/9rcvZoX9ah
r6exLp5nbj+itzkO987nerhvstSjtrsXOofdH5/F2Cy9r/c5mwIdTSKCUWowEIoC
CR48YevuSgSaES/YMEyc5GvBDH/Wch0kJ7N2l2CgdJU/MMORvclVGKZhe6lVb4+I
bm21j/pfYVz/3kmaL96D89uiRX1/yq/2xaYOs1gOIJH9mo2Jt1b2rsdBsguSL18+
IAG9ekpnm0UlUVnQ/j0nSbZnc4CxsMyEaaHRQ/Q+Iu8H36e7hYSGpaisuktVmYgP
y18oBx7/3vAENP75y50yarJ9b63VNgAALw1n91tfAKciCKFUlwGAyESqAjgesIsv
CLsDuRsO8mTjMGLOMctaJ7sEAdkihe4M/gu6dpS/mD1aw69mkFnrXzuahcPgjxZ9
fobVq3NtpTDrBmg=
=SDCr
-----END PGP SIGNATURE-----
--- End Message ---
__
This is the maintainer address of Debian's Java team
<https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-java-maintainers>.
Please use
debian-j...@lists.debian.org for discussions and questions.
