The build path is embedded in /usr/lib/libgdome.so.0.8.1:

https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/gdome2.html

  /build/1st/gdome2-0.8.1+debian/libgdome/gdome.c:65
  vs.
  /build/2/gdome2-0.8.1+debian/2nd/libgdome/gdome.c:65


The attached patch to debian/rules fixes this by passing
-ffile-prefix-map in CFLAGS and ensuring CFLAGS is passed to configure.

Alternately, updating the packaging to use dh/debhelper at a recent
compat level would also likely fix this.


With this patch applied, gdome2 should build reproducibly on
tests.reproducible-builds.org!


live well,
  vagrant

We believe that the bug you reported is fixed in the latest version of
gdome2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1010785@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Hugh McMaster <hugh.mcmaster@outlook.com> (supplier of updated gdome2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 08 Jun 2022 10:52:20 +1000
Source: gdome2
Architecture: source
Version: 0.8.1+debian-8
Distribution: unstable
Urgency: medium
Maintainer: Debian QA Group <packages@qa.debian.org>
Changed-By: Hugh McMaster <hugh.mcmaster@outlook.com>
Closes: 875888 895991 949147 1010785
Changes:
 gdome2 (0.8.1+debian-8) unstable; urgency=medium
 .
   * QA upload.
   * debian/copyright: Switch to DEP-5 format.
   * debian/control:
     - Use debhelper-compat v13 (Closes: #875888, #1010785).
     - Raise Standards-Version to 4.6.1 from 3.9.4 (no changes needed).
     - Declare packages Multi-Arch: same.
     - Declare Rules-Requires-Root: no.
     - Build-Depend on pkg-config.
   * debian/patches:
     - Add DEP-3 headers to patches 1 to 4.
     - Patch configure.in to use pkg-config to find libxml2 (Closes: #949147).
     - Update patch 1 to use Autoconf variables instead of calling xml2-config.
   * debian/rules:
     - Switch to the 'dh' build system.
     - Add hardening flags to DEB_BUILD_MAINT_OPTIONS.
   * debian/watch: Update to version 4.
   * libgdome2-0: Add install and symbols files.
   * libgdome2-dev:
     - Add install, docs and examples files.
     - Install gdome2.pc in a multi-arch location (Closes: #895991).
   * Don't install gdome-config, gdomeConf.sh, gdome2.m4 or libgdome.la.
Checksums-Sha1:
 8b454bcab27aa2035866e25f256c3b1654ccd707 1732 gdome2_0.8.1+debian-8.dsc
 bd2f63ebbf58c3fff2a2339d0a19774b6adbed20 10956 gdome2_0.8.1+debian-8.debian.tar.xz
 bbc3c620f8fab91357a1682c2ea12f257b6d65d0 7234 gdome2_0.8.1+debian-8_source.buildinfo
Checksums-Sha256:
 18969e4b70230f112a72f5987487ac1f85ddf172b7a66039ceb4e0fa38cd2019 1732 gdome2_0.8.1+debian-8.dsc
 49aebdb1e05548621efc6cb72bd20f06269e81ba3d916270ef7707cc6dc137e0 10956 gdome2_0.8.1+debian-8.debian.tar.xz
 410b3e4ed706d3d47a779ad0abb645b08965f20e756b86e9720af0f6e04e8691 7234 gdome2_0.8.1+debian-8_source.buildinfo
Files:
 ac633b5b2bf45b2691006b994d9feea8 1732 libdevel optional gdome2_0.8.1+debian-8.dsc
 9b8349f4efeec7fa1ec1094fb09354eb 10956 libdevel optional gdome2_0.8.1+debian-8.debian.tar.xz
 ac315b302c7eac899736577d226bcfca 7234 libdevel optional gdome2_0.8.1+debian-8_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQHEBAEBCgAuFiEEQGIgyLhVKAI3jM5BH1x6i0VWQxQFAmKg0fYQHGJhZ2VAZGVi
aWFuLm9yZwAKCRAfXHqLRVZDFF0gDADFTw4VuZOVdb527WlEnRZF3unFvCD/2ljk
ipOR6vvUz8SL1QzXfhrc6eZ9hC5q8zgWSF0N1pSnuU093HCI9iKrd9I9gW+omfV3
5HP7CbCuyqmIx944COr8dLug1AICk5zGufPckVPQNfUqfjUefBUUfPq/hVtKF7az
2/nQHmy0+fJI8qRlMBdgWfEmBr0Qj1UCC88VWtZyAN/QsYhgeiq+h9w8v1jlmmNm
lgHRmIaytnkgOzjkSzw75oTzl2QjtEhc9KfQ2nLIxFHVxvJnlhNZo/k8ucpH008k
PB9Zov+5DgNO0qnAtGFme2M7WMv7Ks4aVD5w6MXJmKxrlVG9ugtvM6p6HRVXgCzA
LOWZX16oXYAWHIVY4k+LzmKaWiqzwI6/xLKiPo4S56WiyjqiFKpZsQdlB1jcL0uh
9m3+o0cN+JP0p8yA767C3L2sC+N2pkghKxbHVaYDqZgKfiRR72fT2abYGBCDbiI6
nkvJksYCHLB3b43laXUCH1a0HpLAWEM=
=OKUN
-----END PGP SIGNATURE-----

Control: found 1010785 0.8.1+debian-8

Turns out simply switching to dh/debhelper was not sufficient...

Probably adjusting debian/rules with something like:

override_dh_auto_configure:
    CFLAGS="$(CFLAGS) -ffile-prefix-map=$(CURDIR)" dh_auto_configure

I'll try and provide an updated patch and confirm the fix at some
point... though if someone else does it first I won't complain! :)


live well,
  vagrant

Hi Vagrant,

Actually, switching to debhelper v13 was fine. The problem was the
manual CFLAGS logic in debian/rules.

With that removed and handled by debhelper, -ffile-prefix-map is
passed to the compiler correctly, along with other hardening and
security flags.

I ran `reprotest` with the attached patch applied and the builds were
reproducible. `blhc` also had no output (meaning there were no
issues).

I've uploaded a build to Debian Mentors [1]. If you are happy to
sponsor the upload, please do. Otherwise, please apply the patch and
upload yourself.

Hugh

[1] https://mentors.debian.net/debian/pool/main/g/gdome2/gdome2_0.8.1+debian-9.dsc

Hi Vagrant,

I've just updated the changelog and Debian Mentors upload to actually
close the bug.

Link to the dsc file remains the same [1].

Hugh

[1] https://mentors.debian.net/debian/pool/main/g/gdome2/gdome2_0.8.1+debian-9.dsc

We believe that the bug you reported is fixed in the latest version of
gdome2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1010785@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Hugh McMaster <hugh.mcmaster@outlook.com> (supplier of updated gdome2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 22 Jun 2022 09:58:41 +1000
Source: gdome2
Architecture: source
Version: 0.8.1+debian-9
Distribution: unstable
Urgency: medium
Maintainer: Debian QA Group <packages@qa.debian.org>
Changed-By: Hugh McMaster <hugh.mcmaster@outlook.com>
Closes: 1010785
Changes:
 gdome2 (0.8.1+debian-9) unstable; urgency=medium
 .
   * QA upload.
   * debian/rules: Remove manual CFLAGS handling and let debhelper pass valid
     optimization flags to enable reproducible builds (Closes: #1010785).
   * debian/patches: Output the GDOME_TEXT_NODE string to stdout. This fixes a
     FTBFS bug exposed by the CFLAGS changes.
Checksums-Sha1:
 4ffc76fdb0543bb1f35f3ff0790fe90f373b6cc7 1732 gdome2_0.8.1+debian-9.dsc
 6cfbab65678e3c3291542cc001dd5fae6e3d5f87 11328 gdome2_0.8.1+debian-9.debian.tar.xz
 ed9f7779093b99769dbb0dc1feb38ebebb19fee6 7248 gdome2_0.8.1+debian-9_source.buildinfo
Checksums-Sha256:
 f969d3486e99b00217d36d09c126882ac2a093a081aad2cb74c97119644e0838 1732 gdome2_0.8.1+debian-9.dsc
 2dc55a18825e48e7c720e46ca1b8f6b85c0628f8b0cd5f233034f153354bc870 11328 gdome2_0.8.1+debian-9.debian.tar.xz
 f0f8d32591ad9d66ee934a0feeb86ef85220a1cd8735398313a1b5b71835f4e2 7248 gdome2_0.8.1+debian-9_source.buildinfo
Files:
 25a8f08bc192cea2367b1826beb57d45 1732 libdevel optional gdome2_0.8.1+debian-9.dsc
 13411cb7193003cbea870bd78d04a76c 11328 libdevel optional gdome2_0.8.1+debian-9.debian.tar.xz
 dd63ebce4e929d5f7598a91b07c1a8a8 7248 libdevel optional gdome2_0.8.1+debian-9_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQHEBAEBCgAuFiEEQGIgyLhVKAI3jM5BH1x6i0VWQxQFAmKyz78QHGJhZ2VAZGVi
aWFuLm9yZwAKCRAfXHqLRVZDFEFgC/4hO6Ql177sbis3haJS17UuoYPihMaPYiiW
5QOJNE7cm1bdFnEvtZ4QaKyJa3TW/gVKFGUjitFr5626q10XfmoR6uQIqioOpihL
9jSVu2p5eLMbqRRNtzQr34F1h54YC5u+sIRw4SAUpGmfm2JUPCA4cqzGXxMCA3iC
1t64n+hrnk5Jp0LoZ456J/1G37ZqGRWcfyrHAyOxV6PAuDC2d5gOcUGvczPKDk2u
v6iiS05dPYNSIqdfxEc+TUC37erp4wQIJM2f2W3maTy/rgyMTq86C4ZQ2bkdvXQh
kpxojHY3fF1xZG1nxI9ZSZqKxjQG4FW9ZX83EVr4AWRPQ782qSphrdVtwSjM2RXm
35/7MXJQRrjENGfQ5aqgejNDSK1yrY+fYA2zPYaNbQS1YcJ2jMC0lBPI32DEpGUF
FlrHXDc1EQbrLEKGkle9IMCH4ktxn4rM7nCFuU6GCRH4hrxF8mItuk83fG0ZXeYT
LTNQQMuUMk5dY4x3KwkXTu/83sdgWiI=
=BfQS
-----END PGP SIGNATURE-----