Hi,

Whilst working on the Reproducible Builds effort [0] we noticed that
cdebootstrap could not be built reproducibly.

This is the because the embedded .tar file does not sort its entries
so it inherits the (non-deterministic) filesystem ordering.

Patch attached that adds --sort=name (next to --mtime=[..]) that makes
the build reproducible for me locally.

 [0] https://reproducible-builds.org/


Regards,

Hi Bastian,

* Chris Lamb <lamby@debian.org> [2021-03-16 09:19]:


I have just tested this and it makes the package reproducible for me. Is
there anything blocking the integration of this?

Cheers Jochen

...

This also requires passing "--owner=0 --group=0 --numeric-owner" to tar
in debian/rules and setting "Rules-Requires-Root: binary-targets" in
debian/control, otherwise the username, groupname and user id and group
id also get embedded in both the tarball:

https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/cdebootstrap.html

  ./usr/lib/cdebootstrap/cdebootstrap_0.7.9_amd64.tar

  drwxr-xr-x···0·pbuilder1··(1111)·pbuilder1··(1111)········0·2025-07-21·14:33:58.000000·./
  vs.
  drwxr-xr-x···0·pbuilder2··(2222)·pbuilder2··(2222)········0·2025-07-21·14:33:58.000000·./

and the package metadata itself:

  ./usr/share/cdebootstrap/cdebootstrap-helper-rc.d.deb

  drwxr-xr-x···0·pbuilder1··(1111)·pbuilder1··(1111)········0·2025-07-21·14:33:58.000000·./
  vs.
  drwxr-xr-x···0·pbuilder2··(2222)·pbuilder2··(2222)········0·2025-07-21·14:33:58.000000·./

I would like to perform an Non-Maintainer Upload to fix this issue in
the following week or two; are there any outstanding concerns?

In lieu of setting Rules-Requires-Root, possibly using a newer
debhelper-compat version might also help...


live well,
  vagrant

Hi Vagrant,

* Vagrant Cascadian <vagrant@reproducible-builds.org> [2026-09-24 12:33]:

Good point. I had missed that because sbuild always uses a fixed
username nowadays so it is less important but still a good idea.

I don't see a need for that and I just tested the change without and
build is fine and autopkgtest runs without problem. As we only change a
tar call I don't think there is a need.

In general we try to avoid R³ binary-targts as it makes reproducing much
harder and in case there is a need debputy should be the better option.

Cheers Jochen

Well, tests.reproducible-builds.org still shows differences in the
various package data.tar.gz, so it will continue to be unreproducible
there unless that part gets fixed:

https://tests.reproducible-builds.org/debian/rb-pkg/forky/amd64/diffoscope-results/cdebootstrap.html

Less important, but my test setup also tests this... :)

With a closer look, it only appears to be the directories in the
data.tar.gz, not the regular files...

Open to other ideas of how to fix it properly. Might try to poke at this
a little more...


live well,
  vagrant

...

Ok, passing "dpkg-deb --root-owner-group" in helper/Makefile.am did the trick!

So, a complete patch that works for me:

diff --git a/debian/rules b/debian/rules
index deb2cfa..9742b75 100755
--- a/debian/rules
+++ b/debian/rules
@@ -38,7 +38,10 @@ override_dh_auto_install:

        dh_auto_install --builddir build-tar --destdir debian/tmp
        strip --remove-section=.comment --remove-section=.note debian/tmp/usr/bin/cdebootstrap
-       tar -C debian/tmp/usr/bin --mtime=@$(SOURCE_DATE_EPOCH) -cf debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar .
+       tar -C debian/tmp/usr/bin --sort=name \
+               --owner=0 --group=0 --numeric-owner \
+               --mtime=@$(SOURCE_DATE_EPOCH) \
+               -cf debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar .
        mkdir -p debian/cdebootstrap-static/usr/lib/cdebootstrap
        cp debian/tmp/cdebootstrap_$(DEB_VERSION)_$(DEB_HOST_ARCH).tar debian/cdebootstrap-static/usr/lib/cdebootstrap

diff --git a/helper/Makefile.am b/helper/Makefile.am
index 934e1e1..b9291b5 100644
--- a/helper/Makefile.am
+++ b/helper/Makefile.am
@@ -24,7 +24,7 @@ temp-%:
        $(MAKE) -C $(PACKAGE) package DESTDIR=$(CURDIR)/temp-$(PACKAGE)

 root-%:
-       dpkg-deb -Zgzip --build temp-$(PACKAGE) $(PACKAGE).deb
+       dpkg-deb -Zgzip --root-owner-group --build temp-$(PACKAGE) $(PACKAGE).deb

 clean-local:
        rm -rf $(foreach package,$(packages),temp-$(package))


I would like to perform a Non-Maintainer Upload (NMU) with this patch in
the coming weeks.

Any outstanding concerns?

live well,
  vagrant

...

I have uploaded an NMU to DELAYED/10, debdiff attached.

More granular git commits are available via dgit.

live well,
  vagrant