Hi,

Whilst working on the Reproducible Builds effort [0], we noticed that
setuptools can generate nondeterministic PKG-INFO files.

For example, here is python-pylatex:

   ├── ./usr/lib/python3/dist-packages/PyLaTeX-1.4.2.egg-info/PKG-INFO
   │┄ Ordering differences only
   │ @@ -42,27 +42,27 @@
   │  Requires-Dist: coverage; extra == "testing"
   │  Requires-Dist: pytest-cov; extra == "testing"
   │  Requires-Dist: black; extra == "testing"
   │  Requires-Dist: isort; extra == "testing"
   │  Provides-Extra: packaging
   │  Requires-Dist: twine; extra == "packaging"
   │  Provides-Extra: all
   │ +Requires-Dist: isort; extra == "all"
   │ +Requires-Dist: quantities; extra == "all"
   │ +Requires-Dist: alabaster<0.7.12; extra == "all"
   │ +Requires-Dist: numpy; extra == "all"
   │  Requires-Dist: pytest>=4.6; extra == "all"
   │ +Requires-Dist: black; extra == "all"
   │ +Requires-Dist: matplotlib; extra == "all"
   │ +Requires-Dist: MarkupSafe==2.0.1; extra == "all"
   │ +Requires-Dist: coverage; extra == "all"
   │  Requires-Dist: twine; extra == "all"
   │ +Requires-Dist: jinja2<3.0; extra == "all"
   │  Requires-Dist: sphinx; extra == "all"
   │ -Requires-Dist: numpy; extra == "all"
   │ -Requires-Dist: quantities; extra == "all"
   │ -Requires-Dist: coverage; extra == "all"
   │ -Requires-Dist: black; extra == "all"
   │ -Requires-Dist: alabaster<0.7.12; extra == "all"
   │ -Requires-Dist: isort; extra == "all"
   │  Requires-Dist: pytest-cov; extra == "all"
   │ -Requires-Dist: jinja2<3.0; extra == "all"
   │ -Requires-Dist: MarkupSafe==2.0.1; extra == "all"
   │ -Requires-Dist: matplotlib; extra == "all"

The patch (also attached) is fairly simple:

We believe that the bug you reported is fixed in the latest version of
setuptools, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1077601@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Matthias Klose <doko@debian.org> (supplier of updated setuptools package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 09 Sep 2024 16:20:00 +0200
Source: setuptools
Architecture: source
Version: 74.1.2-2
Distribution: unstable
Urgency: medium
Maintainer: Matthias Klose <doko@debian.org>
Changed-By: Matthias Klose <doko@debian.org>
Closes: 1077601
Changes:
 setuptools (74.1.2-2) unstable; urgency=medium
 .
   * generate nondeterministic PKG-INFO files (Chris Lamb).
     Closes: #1077601.
Checksums-Sha1:
 d2a8cddcb03eada55ac697cfd39dbe5f30b4929b 2164 setuptools_74.1.2-2.dsc
 9b6c8a478d2706b1800b1899f4d77ce1011ed4ed 14688 setuptools_74.1.2-2.debian.tar.xz
 fc9fa44670e01bb6c972e4f9b395cda3c179bab2 8160 setuptools_74.1.2-2_source.buildinfo
Checksums-Sha256:
 9e33c65a98778117b09361894f9c8d64e9aa0f9900b6d522d3afe989f10a419c 2164 setuptools_74.1.2-2.dsc
 7ad3f669f6cc40e7bdb89b1d20557c169f22c823ad40bea5d9a7d6f95dfd8841 14688 setuptools_74.1.2-2.debian.tar.xz
 56a40f3857b3b5bfdd3d5e07a9633b2e76511fc7cf14b10597e95f5c46a42ac2 8160 setuptools_74.1.2-2_source.buildinfo
Files:
 e6e8bfe6734274e0c688313c33154673 2164 python optional setuptools_74.1.2-2.dsc
 9233242aa85786653392c57514cdd9fb 14688 python optional setuptools_74.1.2-2.debian.tar.xz
 359b5964817831d66f1a12a4822bbd5e 8160 python optional setuptools_74.1.2-2_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJEBAEBCgAuFiEE1WVxuIqLuvFAv2PWvX6qYHePpvUFAmbfBG0QHGRva29AZGVi
aWFuLm9yZwAKCRC9fqpgd4+m9Ru0D/99tKtmgp3NivcaArvrW49k5zoF2DkdwuoN
UiJXelsFNLkGv8pxFAhk+wo8Y95uAnnwWceAauf58rQyhgmHpBxc2Fnn2rFOO/Qk
cT9AXRjlenFHVEiJxNDODHBOTknr2A8JYnoDBFE1aO4fpQulGAPC2ICcpDK8LerS
Zz7B5DmZPscmsHr4N72ZxM8I8klse403nQ1Cx5DcBMmrU/ExygzoMmg4GwaHCAWh
nVNcGXi3QReJSBS3nIQ/PaL6nB0x4AXy/RVesRt615PkTqmMIs/wMGXWMRbOC1oG
Oc8ckLd3dA2m0EJtqi/WghqWKwvsIfNSnsVG+Py6pZ1YE7o5m/3ydgJu9+TRBGEi
5UpHG3ws+hQhg8StSbbgtcPbv/0cRnmfXxv3sxJEm3ETdOl01xuWtS5h9v7UlU8S
bHuW9AAVVwg2JQz6Cx9v4aj/YkBiWvRVqRjM4jRK+InkA3ygMKKdCv3Lg2mkaVE6
QMnLf1wdGLEV5PU8byKLrwZv+7ysVxFhGyej7W2ttDVgixfVI0qhkMcp/Vgov5r9
P5aft+TxXmq218tMg+7RvpBj9EASqz1pytFtX5vkf8GpDbT4arINCevF5vXSEbvp
ye+jDReFssUjfRtCINrXEmdwdUeib1dnmd8PB7f3PVlznC3gVOEZa4DpQORfiDKc
GeElKKb3cg==
=Q4tA
-----END PGP SIGNATURE-----

Dear Chris and Matthias,

setuptools (74.1.2-2) changelog says:

Perhaps this should be changed to one of the following,
or something similar?
  * generate deterministic PKG-INFO files (Chris Lamb).
  * generate reproducible PKG-INFO files (Chris Lamb).

Thank you!
Daniel Lewart
Urbana, Illinois

found 1077601 75.2.0-1
tags 1077601 + patch
thanks

I don't think this is a regression given that this bit of the method
has always been there, so I think my original patch did not take into
account all possible variations..

Here is an example of setuptools varying the contents of PKG-INFO (from
src:domain2idna):

 /usr/lib/python3/dist-packages/domain2idna-1.12.2.egg-info/PKG-INFO
 ┄ Ordering differences only
  @@ -14,16 +14,16 @@
   Description-Content-Type: text/markdown
   License-File: LICENSE
  -Requires-Dist: setuptools>=65.5.1
   Requires-Dist: colorama
  +Requires-Dist: setuptools>=65.5.1
   Provides-Extra: test

The patch to setuptools (also attached) is: