Hi,
configure.ac records the build user ($USER, else $LOGNAME) and host
name ($HOSTNAME, else $HOST) in config.h, and libnco embeds both:
"ncks --version" prints them (the amd64 package in unstable says
"built by sbuild on sbuild"), and the grid, skeleton, map, UGRID and
TERRAREF writers put the user name in the created_by attribute. A build
by another user or on another host therefore produces a different
libnco-5.4.1.so.
The reproducible-builds CI varies both and lists 5.4.1-1 as
unreproducible; its diff shows the two user names and host names in
libnco [1]. reproduce.debian.net does rebuild the official amd64 binary
bit for bit [2], presumably because its rebuild uses the same "sbuild"
names. The .buildinfo records neither value.
To reproduce (configure takes both values from the environment when
they are set):
dpkg-source -x nco_5.4.1-1.dsc && cd nco-5.4.1
USER=alice HOSTNAME=host-a DEB_BUILD_OPTIONS=nocheck
dpkg-buildpackage -b -us -uc
mv ../nco_5.4.1-1_amd64.deb ../nco-host-a.deb
USER=bob HOSTNAME=host-b DEB_BUILD_OPTIONS=nocheck dpkg-buildpackage
-b -us -uc
cmp ../nco-host-a.deb ../nco_5.4.1-1_amd64.deb
What I tested, in a sid chroot (dpkg 1.23.11, debhelper 14.5,
autoconf 2.73-2, gcc-16 16.2.0-4), with dpkg-buildpackage run as
non-root users and DEB_BUILD_OPTIONS=nocheck:
* The commands above: the two packages differ; config.h records
alice/host-a and bob/host-b.
* Unpatched, changing only USER/LOGNAME (same uid), or only the host
name, changes both nco and nco-dbgsym. In nco, the only differing
file is usr/lib/nco/libnco-5.4.1.so (and therefore md5sums).
* With the attached patch added as debian/patches/<patch> plus a
series file, and no other change, two builds from the resulting
source package (dpkg-source -b) that differed in user and uid, host
name, build path, LANG, time zone (UTC vs UTC+14), parallel= and
uname gave identical packages:
nco_5.4.1-1_amd64.deb
aec58fac88295e44e85a88e76984813e9a7fbd77bfee88acfa144f8b5a65b93d
nco-dbgsym_5.4.1-1_amd64.deb
a4298c2dc0565a4ab31497dd36eae6a7bde4392cd5df6f20714025b3837fefee
dh_autoreconf regenerates configure from the patched configure.ac.
Three earlier builds of the same change (it differed only in a code
comment), and three with the debian/rules alternative below, gave
the same two hashes.
* bm/nco_bm.pl --regress against the installed package: 486 tests,
474 pass, 12 fail, with the same per-test results unpatched and
patched (the patched run used the byte-identical package from the
debian/rules alternative).
The patch is the configure.ac change I proposed upstream [3], not yet
reviewed there (upstream also gets the regenerated configure; here
dh_autoreconf regenerates it). When SOURCE_DATE_EPOCH is set and
non-empty, which dpkg-buildpackage ensures, configure records "nobody"
and "nowhere" (its existing fallbacks); builds without it are
unchanged. Visible effect in the package: "ncks --version" says "built
by nobody on nowhere", and created_by becomes "nobody" instead of
"sbuild". The patch can be dropped once an upstream release includes
it.
If you would rather not carry an upstream change, pinning the values in
debian/rules gives the same package hashes (tested):
override_dh_auto_configure:
USER=nobody HOSTNAME=nowhere dh_auto_configure -- \
(existing arguments unchanged)
Unexporting USER and HOSTNAME is not enough: configure re-executes
itself under bash, which sets HOSTNAME from the system host name when
it is not in the environment.
[1] https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/nco.html
[2] https://reproduce.debian.net/amd64/api/v0/pkgs/list?name=nco
(5.4.1-1: GOOD)
[3] https://github.com/nco/nco/pull/324
Regards,
Zackary Loevseth