#1020725 snapper: reproducible-builds: Embedded build path in example Makefile

Package:
src:snapper
Source:
src:snapper
Submitter:
Vagrant Cascadian
Date:
2024-03-13 09:21:19 UTC
Severity:
normal
Tags:
#1020725#5
Date:
2022-09-25 20:01:01 UTC
From:
To:
The build path is embedded in
/usr/share/doc/libsnapper-dev/examples/Makefile:

https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/snapper.html

  ACLOCAL·=·${SHELL}·'/build/1st/snapper-0.10.2/missing'·aclocal-1.16
  vs.
  ACLOCAL·=·${SHELL}·'/build/2/snapper-0.10.2/2nd/missing'·aclocal-1.16

The attached patch fixes this in debian/rules by removing the Makefile
in a dh_installexamples override. Removing the Makefile seems better
than sanitizing the build path, as in order to use it, one would have to
regenerate it from the provided Makefile.in or Makefile.am to match the
running system.

With this patch applied (and another recently submitted to fix usrmerge
issues) snapper should build reproducibly on
tests.reproducible-builds.org!

Thanks for maintaining snapper!

live well,
  vagrant

#1020725#10
Date:
2024-03-12 22:33:24 UTC
From:
To:
Dear Maintainer,

Because Debian builds packages from a fixed build path, neither the 'reprotest'
utility in Salsa-CI, nor the Reproducible Builds team's package test
infrastructure for Debian[1] currently check for equivalent binary package
output from differing source package build paths.

This means that your package will pass current reproducibility tests; however
we believe that source code and/or build steps still embed the build path into
the binary package output, making it more difficult than necessary for
independent consumers to check the integrity of those packages by rebuilding
them themselves.

As a result, this bugreport will remain open and be re-assigned the 'wishlist'
severity[2].

For more information about build paths and how they can affect reproducibility,
please refer to: https://reproducible-builds.org/docs/build-path/

Thanks,
James

[1] - https://tests.reproducible-builds.org/debian/reproducible.html

[2] - https://www.debian.org/Bugs/Developer#severities

#1020725#17
Date:
2024-03-13 09:18:02 UTC
From:
To:
A correction for a mistake in my previous message:

Currently the 'reprotest' job in Salsa-CI does in fact continue to exercise
variations of the build-path, and will fail if it builds binary packages that
contain different contents as a result.