Hi Hilko,

libguestfs in unstable can't migrate to testing because the QA
infrastructure couldn't reproduce the binary packages in unstable while
it could reproduce the version in testing [1, 2].

It looks like this is due to the tar command in supermin:

https://sources.debian.org/src/supermin/5.2.2-8/src/mode_prepare.ml?hl=74&pow_referer=https%3A%2F%2Fcodesearch.debian.net%2F#L169

See [4] for some information on how to make tar reproducible. As you
maintain both packages, I am filing only one bug for now.

Feel free to reach out if you need help with this.

Cheers Jochen


[1] https://qa.debian.org/excuses.php?package=libguestfs
[2] https://lists.debian.org/debian-devel-announce/2026/05/msg00001.html
[3] https://lists.debian.org/debian-devel/2026/05/msg00383.html
[4] https://reproducible-builds.org/docs/archives/

We believe that the bug you reported is fixed in the latest version of
libguestfs, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1147388@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Hilko Bengen <bengen@debian.org> (supplier of updated libguestfs package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 13 Sep 2026 15:27:30 +0200
Source: libguestfs
Architecture: source
Version: 1:1.60.1-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Libvirt Maintainers <pkg-libvirt-maintainers@lists.alioth.debian.org>
Changed-By: Hilko Bengen <bengen@debian.org>
Closes: 1147388
Changes:
 libguestfs (1:1.60.1-2) unstable; urgency=medium
 .
   * Rework appliance patches; ensure supermin is run with TAR_OPTIONS.
     (Closes: #1147388)
Checksums-Sha1:
 07804c601967e7a125a85b9b78493a8c3d6cd542 7177 libguestfs_1.60.1-2.dsc
 4806c00da39fd026f956ed0140254bf6fa20ed40 45844 libguestfs_1.60.1-2.debian.tar.xz
 ce500994424f977b884bc6897639c5b048934993 16377 libguestfs_1.60.1-2_source.buildinfo
Checksums-Sha256:
 9ca5a041da1bc561ec6ebb06aa60524be384e3d27acbcf93292ae150242369d8 7177 libguestfs_1.60.1-2.dsc
 e12805ffb8a65bf59a11f4dedeeeb38b1c41f810509bbd159a1732d853379e90 45844 libguestfs_1.60.1-2.debian.tar.xz
 84c1a1b231aff8f3518543d2965557b5404842953511249d745df826f4aa23b2 16377 libguestfs_1.60.1-2_source.buildinfo
Files:
 acd9da8735e753486af9f7ce1351990e 7177 libs optional libguestfs_1.60.1-2.dsc
 107689ec70295b86fc946c0effdacb2d 45844 libs optional libguestfs_1.60.1-2.debian.tar.xz
 576512d47fffd7bba7c10e7b7e899be0 16377 libs optional libguestfs_1.60.1-2_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEErnMQVUQqHZbPTUx4dbcQY1whOn4FAmqmrdUACgkQdbcQY1wh
On5Uig//VJ68u2QtR0RoX6DdZZLTnNRO7mLZ410yuRQ+KI0+OxkS8PVvi7bFq4Gh
vVc2u5h3+xLGE7do6YYXmOP8xEUz0XDLSmsUdMXDkgatkRfaMivdmZpgnSVBkNeU
sZ8M/eh1gQfq+ZUJIfSShvRLLgt5Akq3yiRQ9qzPX4zYf8BkDQZJNkJ316ZksWgc
LL3be4EG0IJBRNyk8mcmby3d5Uawn9DU6OTCPIVvq8fI3XOt+HjsgsQy9nLZ2ySh
Ax7JuDKjKEc+bs0Wow3utFViBWpMw8lbA7oOoffoS87r37otCh40hhvHuHY6e/Le
ZcPG71fMAhaF8YwesdV9dQwVvA3lxOEPD3GHGAT2uc7XyNlayvnnVCe8KpJjS0Yc
1ZtaIvQDywFLx7KeCpnp++0wM37BqKjPSmXf+TGs1Fg3syeQm0x3uxZpMkrGktjc
7F4PLfH2DgN30HV4+t47Z5h7hkxAgUQizWfIM0hW4Nh/l5+hebLhTpO8sEz3cSau
jsJOZCIg5OwokV8zRqHu5GgkTcfG/LEJix7r221R/uWI0H0nOQ74UX0L4AtHhNC0
FuII2VZYmWQ53TaIBJV+U6KP7oR1W98JQDBkqBziBHqotky2Lp8mrnx/nkoJS1AX
4zbxawRpXlNw0ij11inkCJ5PWEwoxjF4H2wI7XQqENvF8ix5DaE=
=BbkF
-----END PGP SIGNATURE-----

* Jochen Sprickerhof:

Your analysis seems spot on, thank you.

There already is code in libguestfs to pass --mtime=¼$SOURCE_DATE_EPOCH
via TAR_OPTIONS but there seemed to be a missing spot. I chose to fill
in the bits in libguestfs rather than adding special code for handling
SOURCE_DATE_EPOCH to supermin. I hope it works as expected. :-)

Cheers,
-Hilko