Bug#1078153: pan: please make the build reproducible

[Chris Lamb]

Source: pan
Version: 0.159-1
Severity: wishlist
Tags: patch
User: reproducible-***@lists.alioth.debian.org
Usertags: uname
X-Debbugs-Cc: reproducible-***@lists.alioth.debian.org

Hi,

Whilst working on the Reproducible Builds effort [0], we noticed that
pan could not be built reproducibly.

This is because the /usr/bin/pan binary embedded the kernel version
name and version number:

│ │ │ ├── ./usr/bin/pan
[
]
│ │ │ │ ├── strings --all --bytes=8 {}
│ │ │ │ │ @@ -5307,15 +5307,15 @@
│ │ │ │ │ Heinrich M
│ │ │ │ │ ller <***@gmail.com> - Developer
│ │ │ │ │ Kenneth Haley <***@users.sf.net> - Developer
│ │ │ │ │ Petr Kovar <***@volny.cz> - Contributor
│ │ │ │ │ Calin Culianu <***@ajvar.org> - Threaded Decoding
│ │ │ │ │ Christophe Lambin <***@rebelbase.com> - Original Developer
│ │ │ │ │ Matt Eagleson <***@rebelbase.com> - Original Developer
│ │ │ │ │ -Vovchansk (; Linux-6.9.7+bpo-amd64)
│ │ │ │ │ +Vovchansk (; Linux-6.1.0-23-amd64)
│ │ │ │ │ Copyright
│ │ │ │ │ 2002-2021 Charles Kerr and others
│ │ │ │ │ GNU GENERAL PUBLIC LICENSE


A patch is attached that has the effect that, if SOURCE_DATE_EPOCH
exists, we assume that a reproducible build is intended and the
"Linux-6.1.0-23-amd64" string is replaced with "-" (hyphen).

[0] https://reproducible-builds.org/


Regards,

[Dominique Dumont]

Hi

If that's ok with you, I'll set PLATFORM_INFO to "Debian" when
SOURCE_DATE_EPOCH is set.

This way, as upstream, I have a better hint of the origin of Pan when a user
reports a bug.

Thanks for the report.

All the best

Post by Chris Lamb
Source: pan
Version: 0.159-1
Severity: wishlist
Tags: patch
Usertags: uname
Hi,
Whilst working on the Reproducible Builds effort [0], we noticed that
pan could not be built reproducibly.
This is because the /usr/bin/pan binary embedded the kernel version
│ │ │ ├── ./usr/bin/pan
[…]
│ │ │ │ ├── strings --all --bytes=8 {}
│ │ │ │ │ Heinrich M
│ │ │ │ │ -Vovchansk (; Linux-6.9.7+bpo-amd64)
│ │ │ │ │ +Vovchansk (; Linux-6.1.0-23-amd64)
│ │ │ │ │ Copyright
│ │ │ │ │ 2002-2021 Charles Kerr and others
│ │ │ │ │ GNU GENERAL PUBLIC LICENSE
A patch is attached that has the effect that, if SOURCE_DATE_EPOCH
exists, we assume that a reproducible build is intended and the
"Linux-6.1.0-23-amd64" string is replaced with "-" (hyphen).
[0] https://reproducible-builds.org/
Regards,

[Chris Lamb]

Hi Dominique,

Post by Dominique Dumont
If that's ok with you, I'll set PLATFORM_INFO to "Debian" when
SOURCE_DATE_EPOCH is set.

That would indeed be reproducible, but it has a few problems in that
it make the patch not upstreamable, and it also might be misleading on
Ubuntu (or any other Debian-derivative).


Regards,

[Dominique Dumont]

Post by Chris Lamb
That would indeed be reproducible, but it has a few problems in that
it make the patch not upstreamable, and it also might be misleading on
Ubuntu (or any other Debian-derivative).

That's a good point.

Ok, then I'll apply this patch upstream.

Thanks for the advice.