The build timestamp is embedded in u2f-host.pdf:

https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/libu2f-host.html

  ./usr/share/doc/libu2f-host-dev/u2f-host.pdf

  November·15,·2021
  vs.
  December·20,·2022


The attached patch fixes this by setting FORCE_SOURCE_DATE=1 in
debian/rules, which texlive needs in order to respect SOURCE_DATE_EPOCH,
which is set during debian package builds to the timestamp in the latest
debian/changelog entry.

https://reproducible-builds.org/docs/source-date-epoch/

With this patch applied, libu2f-host should build reproducibly on
tests.reproducible-builds.org.


Thanks for maintaining libu2f-host!


live well,
  vagrant

Hello,

Bug #1000836 in libu2f-host reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian/libu2f-host/-/commit/403b2002ebebad3d56ac56804133604cb0cc73e0

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1000836

We believe that the bug you reported is fixed in the latest version of
libu2f-host, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1000836@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Simon Josefsson <simon@josefsson.org> (supplier of updated libu2f-host package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 29 Aug 2025 20:00:33 +0200
Source: libu2f-host
Architecture: source
Version: 1.1.10-4
Distribution: unstable
Urgency: medium
Maintainer: Debian Security Tools <team+pkg-security@tracker.debian.org>
Changed-By: Simon Josefsson <simon@josefsson.org>
Closes: 1000836 1038319
Changes:
 libu2f-host (1.1.10-4) unstable; urgency=medium
 .
   * Team upload.
   * Fix Vcs-* URLs.
   * Change Maintainer: to pkg-security.  Drop upstream Uploaders:.
   * Run wrap-and-sort -satbk.
   * Add d/salsa-ci.yml.
   * Bump debian/* copyright years.
   * Mark libu2f-host-dev as Multi-Arch: same.
   * Drop libu2f-udev package.  Closes: #1038319.
   * Drop PDF manual.  Closes: #1000836.
   * Use github as Homepage: for EOL'd project.
   * Add upstream/metadata.
   * Standards-Version: 4.7.2.
Checksums-Sha1:
 ac3d287c07f25a32c5c5b1ffaa9cd8f1d38dc09b 2469 libu2f-host_1.1.10-4.dsc
 a16fa24b4dda99b49fcce8e4ef6be04e92b7973d 73680 libu2f-host_1.1.10-4.debian.tar.xz
 751d53c468bfcde0c80de040f83be73e08e45fe8 1863552 libu2f-host_1.1.10-4.git.tar.xz
 7d0da7fddc2c3562ea3d651a0b1447e93cb6e961 18074 libu2f-host_1.1.10-4_source.buildinfo
Checksums-Sha256:
 1c43e07f7f0659f2bc4958558c0fccb5930de88037773653e0add0435bcff887 2469 libu2f-host_1.1.10-4.dsc
 85b1710ddd93692f0121ff7f7447335c68eb53579bc254eec61dc0a8ebe554dc 73680 libu2f-host_1.1.10-4.debian.tar.xz
 0043c0d7b332fb0a78a941f07335f730b5262db91aceac8865c60b3ab6a4a8c6 1863552 libu2f-host_1.1.10-4.git.tar.xz
 290247c5ec471f75df5d8ac0b948b6deaf340d92bec153dd6d4c5ad46dbf203e 18074 libu2f-host_1.1.10-4_source.buildinfo
Files:
 9570450c6ccbba7ab7c31ccfa9a86e19 2469 utils optional libu2f-host_1.1.10-4.dsc
 4e19c3ac38011cc25a88fea64384a7a8 73680 utils optional libu2f-host_1.1.10-4.debian.tar.xz
 ba2130c88fbf1b56fab45b8cc562c397 1863552 utils optional libu2f-host_1.1.10-4.git.tar.xz
 a77c14a1100e40928d713fca56e3b11b 18074 utils optional libu2f-host_1.1.10-4_source.buildinfo
Git-Tag-Info: tag=03cda321990234918cae3e4f1bd6222efdccdfc5 fp=a3cc9c870b9d310abad4cf2f51722b08fe4745a2
Git-Tag-Tagger: Simon Josefsson <simon@josefsson.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmix7wIACgkQYG0ITkaD
wHnGwBAA1Ayyl+NYQkXIlMcr65Xba9J+aO9ZBHd22ny++PaNqMfqVjcUbjBSOctI
Stv55Ts/3Rg1jNAPr+jX+QTHGw+pZfV2wa6xDF+D/+2LGv/71Pn9QdegBAv8VwI0
cl4QyClyhEONCjYb+514w70CEbvTHOvH2OTkPdBbHGIdNVJYdVDxMO6/Dunbx5rx
7kWS1vEhnr/ik6ILBTJ2ZFbuYerChggviPcm3lW2e+Zq/D0yZUljyrCtF/bhlR7o
CEDrobZab/51ZWxlnhQrm2TAt/8P9BD3sQASXVglHc4A01nipkbVezh3yuiV0FQZ
pbJnkuFNT0dwusFztVz8udRr+92HCoy4zZgRCxqHz2CqsMYCANPJOyS21pgN4Gbc
dEb3gIsbFJrNOu/EkHmVNcMLooVYrNjLR3H3CXUGRypYoQZDTsM2STGXkNRKvvMI
mddu+o1tWvJD1zGZ6uy2ELfnwGXmLQPYu9hegKLW3Y2HkHPdxOEgW9WKTwTqBG7c
Jqm3DgEYkuMuAtAHDfV+1iqMiFcYXtuROR0kgrQ9R3zEmwLpRqbptz2Wkh4Gl1hT
exTjKOQmdm1x2JdFkV+Jz1urIhY8EZ3yRb4ZFFRYx2aCz3itRca3SMZ0Nm5amHd2
UlSAfKcFl2QHYqgmznsWVNh7PgxYgrwvwP9+Ay8MZ8NmlDOBVM4=
=OT9Q
-----END PGP SIGNATURE-----