The build path is embedded through various uses of __FILE__ in the
sofia-sip code.

The attached patch fixes this by setting CFLAGS in debian/rules using
dpkg-buildflags, which passes the -ffile-prefix-map argument in recent
versions of dpkg. Alternately, upgrading to a recent debhelper compat
level and dh would also probably fix this issue.


Unfortunately, this patch does not resolve all reproducibility issues in
sofia-sip, but the arch:any packages should be fixed by this change,
leaving only sofia-sip-doc unreproducible.

Applying the patch may also make the diffoscope output more reliable, as
it frequently times out comparing builds from unstable:

https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/sofia-sip.html


Thanks for maintaining sofia-sip!


live well,
  vagrant

The sofia-sip package now appears to build reproducibly[1], so I believe that
this bugreport can be closed.  An upgrade[2] of debhelper appears to have
solved the causes of build-path-related variance.

[1] - https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/sofia-sip.html

[2] - https://salsa.debian.org/pkg-voip-team/sofia-sip/-/commit/4e44c63a722425e074183b20dcfdd17b71b06d36

Source: sofia-sip
Followup-For: Bug #984845
X-Debbugs-Cc: vagrant@reproducible-builds.org
Control: notfixed -1 1.12.11+20110422.1-2.2
solved the problem after all; or indeed that the version indicated when I
closed the bugreport is fixed.  I'll try to confirm exactly what the status
is for this package soon.

Dear Maintainer,

Because Debian builds packages from a fixed build path, customized build paths
are _not_ currently evaluated by the 'reprotest' utility in Salsa-CI, or during
package builds on the Reproducible Builds team's package test infrastructure
for Debian[1].

This means that this package will pass current reproducibility tests; however
we still believe that source code and/or build steps embed the build path into
binary package output, making it more difficult that necessary for independent
consumers to confirm whether their local compilations produce identical binary
artifacts.

As a result, this bugreport will remain open and be assigned the 'wishlist'
severity[2].

Regards,
James

[1] - https://tests.reproducible-builds.org/debian/reproducible.html

[2] - https://www.debian.org/Bugs/Developer#severities