Hi,

Whilst working on the Reproducible Builds effort [0], we noticed that
golang-github-miekg-pkcs11 could not be built reproducibly.

This is because the testsuite also generates a token.object file
under test_data which contains unreproducible data.

A patch is attached that removes this file (along with token.lock).

 [0] https://reproducible-builds.org/


Regards,

Hello,

Bug #1148658 in golang-github-miekg-pkcs11 reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/go-team/packages/golang-github-miekg-pkcs11/-/commit/821889303a6497771f988190e5cef31377832423
Signed-off-by: Simon Josefsson <simon@josefsson.org>
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1148658

We believe that the bug you reported is fixed in the latest version of
golang-github-miekg-pkcs11, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148658@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Simon Josefsson <simon@josefsson.org> (supplier of updated golang-github-miekg-pkcs11 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 22 Sep 2026 21:45:41 +0200
Source: golang-github-miekg-pkcs11
Architecture: source
Version: 1.0.3+dfsg1-4
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Simon Josefsson <simon@josefsson.org>
Closes: 1148658
Changes:
 golang-github-miekg-pkcs11 (1.0.3+dfsg1-4) unstable; urgency=medium
 .
   * Team upload
 .
   [ Simon Josefsson ]
   * Use Standards-Version: 4.7.4
   * Drop Priority: optional
   * Drop Rules-Requires-Root: no
   * Use dh-sequence-golang
   * Use watch v5
   * Use gbp sign-tags
   * Use gbp upstream-vcs-tag
   * Bump compat to 14
   * Bump debian/* copyright years
   * Fix compat 14
 .
   [ Chris Lamb ]
   * Make the build reproducible (Closes: #1148658)
Checksums-Sha1:
 6f26ee47b1b0916595a86a103b64a41c91c1650d 2643 golang-github-miekg-pkcs11_1.0.3+dfsg1-4.dsc
 47c5c2136a7382adf913e9835d6ea7eec5e4fecb 4828 golang-github-miekg-pkcs11_1.0.3+dfsg1-4.debian.tar.xz
 64bc53704d825c17cb7820c8046147855aa390ff 135224 golang-github-miekg-pkcs11_1.0.3+dfsg1-4.git.tar.xz
 2b25c4809c03717eb3c7325e1a0921b0003de445 17822 golang-github-miekg-pkcs11_1.0.3+dfsg1-4_source.buildinfo
Checksums-Sha256:
 b44583aa8ef7df5310625318e960a21527826370b12737f8aef5a30b01cbd932 2643 golang-github-miekg-pkcs11_1.0.3+dfsg1-4.dsc
 df98de38e030ff79edc4aaea6bb1d2d9a242d437e88ddca291ec3002cf061f33 4828 golang-github-miekg-pkcs11_1.0.3+dfsg1-4.debian.tar.xz
 d4701fa190758dfa0a34abcb53b8e8527f4cc978cc1db6d87d0eac2688213fa7 135224 golang-github-miekg-pkcs11_1.0.3+dfsg1-4.git.tar.xz
 6a81cf212677c64fc14e2064743c2ed133116100ba60202b1f3c3df0ff2480f6 17822 golang-github-miekg-pkcs11_1.0.3+dfsg1-4_source.buildinfo
Files:
 3ca485feb17817b0a72642869bb91d6b 2643 golang optional golang-github-miekg-pkcs11_1.0.3+dfsg1-4.dsc
 609c3e3be51bebc272d251eb019eb288 4828 golang optional golang-github-miekg-pkcs11_1.0.3+dfsg1-4.debian.tar.xz
 7fa12a3edf2c46fa73afb2c1a81f28ca 135224 golang None golang-github-miekg-pkcs11_1.0.3+dfsg1-4.git.tar.xz
 40f58f6f37315bfc6db8978ed26752c8 17822 golang optional golang-github-miekg-pkcs11_1.0.3+dfsg1-4_source.buildinfo
Git-Tag-Info: tag=69298a64f06132a0daa50f55e750a6a425105d4f fp=a3cc9c870b9d310abad4cf2f51722b08fe4745a2
Git-Tag-Tagger: Simon Josefsson <simon@josefsson.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqy4VQACgkQYG0ITkaD
wHluHRAAtQF+gOqOZYMLV9RL8w1Bhkt85ojaxVVWUKaoDGsfANmUdJNB1X303gOH
FudAEBVTSUUwi3d5dlCQWCSo9j+IMGCJiXPkvag3F7TrpY2sF6RJIZcfxUKUcfrT
fPdn5Lm4crY9/jxCgk2qdla6hFxmxT/uAmNrwDlkwaGb6Tp+XqLAnIy92n8zbHGA
Rhj9RVooNcWlGW3lp1owS4tWsYh21gbepROyLj0jwEfdAKpFH9NVopRvSpu418zL
wmNOBn8WsueOx8AtoDBdhrpcgKk5FmQ/lzRwNrrlskIA/juTCQQ+8khO3IycKTzD
OH7Pi2CZoO8+UPyIqxhu/ViDtOjTn1dxLBIc3pJO5pNFxbaAZU1aeGIgJNpjnzsp
ck4uxt+yEHDfTLcfCipccyKAdKo2v2RSgSV53opEA+ig3YzzW7du0N0lGjPPE3P0
9e32+fJx5LV9a3D0tVZgLacSrGGWl39t9GCmKr4/OrSyKO0rl/nuMeyMaqlrlGcS
p2KraqyKgRkwSza/WiKUrLyl7/GOColeUoEuqc+HUw4nZn3cIClbpxiHbxZLaAeB
vKccxoqIG+VoqjC1WvCGwtR+F/CeB1EJZrOqq23PqIXSl7ZVanIqSrw/RFQFrad2
lvl5MD9fLJCueyIoMIc81MJ6Qc2Gtn+nHsG+6hqJ6BPrBqAvNnM=
=bhU1
-----END PGP SIGNATURE-----

control: reopen -1

  Unfortunately removal of the token.object file causes all
autopkgtests to fail. I spent some time trying to get things to work
properly if dh_auto_install doesn't install token.object from
test_data/, but was not successful. Maybe there's something in that
existing token.object that's not being properly (re)created via the
invocation of `softhsm2-util` in d/rules?

  For the time being, I've reverted this change for the package and
uploaded a new -5 revision to unblock other package migrations to
testing.

Mathias

Hi Mathias,

Perhaps. I spent a couple of minutes looking at src:softhsm2. On my
machine at least, it seems to be deterministically different between
the two builds:

│ │ │ │ -00000000: 0000 0000 0000 0016 0000 0000 8000 5349  ..............SI
│ │ │ │ +00000000: 0000 0000 0000 0009 0000 0000 8000 5349  ..............SI
                                    ^^

However, I can't work out where these values are coming from. Given
that they are consistent, that would rule out uninitialised memory.
Given the actual values in binary (10110 vs 01001), they are likely
flags of some sort, perhaps from some kind of CONSTANT_A | CONSTANT_B
construction. Just braindumping in case it helps…


Best wishes,