#1039623 shotcut: reproducible-builds: build paths trigger differences, embedded date-based version

Package:
src:shotcut
Source:
src:shotcut
Submitter:
Vagrant Cascadian
Date:
2024-03-13 09:22:39 UTC
Severity:
normal
Tags:
#1039623#5
Date:
2023-06-27 23:14:45 UTC
From:
To:
The RPATH contains a hash of the build path resulting in different
buildid and the SHOTCUT_VERSION is set based on a timezone-dependent
timestamp:

https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/shotcut.html

  /usr/share/metainfo/org.shotcut.Shotcut.metainfo.xml

  <release·version="23.06.20"·date="2023-06-20"/>
  vs.
  <release·version="23.06.21"·date="2023-06-21"/>

The attached patches modify debian/rules to pass
-DCMAKE_BUILD_RPATH_USE_ORIGIN=ON to dh_auto_configure to use a relative
path for rpath, and modify CmakeLists.txt to set SHOTCUT_VERSION using
UTC for the timezone.

With both these patches applied, based on my local tests, shotcut should
build reproducibly on tests.reproducible-builds.org!

Thanks for maintaining shotcut!

live well,
  vagrant
#1039623#10
Date:
2024-03-12 21:43:39 UTC
From:
To:
severity -1 wishlist
thanks

Dear Maintainer,

Because Debian builds packages from a fixed build path, neither the 'reprotest'
utility in Salsa-CI, nor the Reproducible Builds team's package test
infrastructure for Debian[1] currently check for equivalent binary package
output from differing source package build paths.

This means that your package will pass current reproducibility tests; however
we believe that source code and/or build steps still embed the build path into
the binary package output, making it more difficult than necessary for
independent consumers to check the integrity of binary packages by recompiling
them themselves.

As a result, this bugreport will remain open and be re-assigned the 'wishlist'
severity[2].

For more information about build paths and how they can affect reproducibility,
please refer to: https://reproducible-builds.org/docs/build-path/

Thanks,
James

[1] - https://tests.reproducible-builds.org/debian/reproducible.html

[2] - https://www.debian.org/Bugs/Developer#severities
#1039623#15
Date:
2024-03-12 21:52:57 UTC
From:
To:
#1039623#22
Date:
2024-03-13 09:18:02 UTC
From:
To:
A correction for a mistake in my previous message:

Currently the 'reprotest' job in Salsa-CI does in fact continue to exercise
variations of the build-path, and will fail if it builds binary packages that
contain different contents as a result.