bugGNU troff - Bugs: bug #57218, Reproducible builds support is...

 
 

bug #57218: Reproducible builds support is broken and embeds timezone

Submitted by:  Eli Schwartz <eschwartz>
Submitted on:  Wed 13 Nov 2019 05:58:06 AM UTC  
 
Category:  Core Severity:  3 - Normal
Item Group:  Build/Installation Status:  None
Privacy:  Public Assigned to:  Bertrand Garrigues <bgarrigues>
Open/Closed:  Open Planned Release:  None

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 13 Nov 2019 06:09:28 AM UTC, comment #1: 

It was pointed out by another reproducible-builds.org member that Debian's man-db package produces reproducible .ps files, so I dug around a little, and it turns out debian's groff package has a downstream patch to work around this issue!

https://salsa.debian.org/debian/groff/blob/master/debian/patches/display-utc-times.patch

This patch should be incorporated upstream if possible. Was it ever proposed here? Is it suitable for inclusion as-is?

Eli Schwartz <eschwartz>
Wed 13 Nov 2019 05:58:06 AM UTC, original submission:  

Reproducible builds support was initially implemented via https://git.savannah.gnu.org/cgit/groff.git/commit/?id=e4290210f2c1db5292d97678197a986d6822d044

See discussion here:
https://lists.gnu.org/archive/html/groff/2014-08/msg00112.html
https://lists.gnu.org/archive/html/groff/2015-11/msg00013.html

However, the implementation falls short of true reproducibility. I've been attempting to reproduce Arch Linux's "man-db" package, and discovered that /usr/share/doc/man-db/man-db-manual.ps is not reproducible, with this differing content:

│ ├── usr/share/doc/man-db/man-db-manual.ps
│ │ @@ -1,10 +1,10 @@
│ │  %!PS-Adobe-3.0
│ │  %%Creator: groff version 1.22.4
│ │ -%%CreationDate: Wed Oct 23 21:52:35 2019
│ │ +%%CreationDate: Wed Oct 23 15:52:35 2019
│ │  %%DocumentNeededResources: font Times-Bold
│ │  %%+ font Times-Italic
│ │  %%+ font Times-Roman
│ │  %%+ font Symbol
│ │  %%DocumentSuppliedResources: procset grops 1.22 4
│ │  %%Pages: 26
│ │  %%PageOrder: Ascend

Note the CreationDate. I'm building the software using an exported SOURCE_DATE_EPOCH=1571860355

It is successfully built in the past, but on the other hand, it does not include a timezone, it is not in UTC time, and my timezone, -0500, is being embedded here:

$ date -R -d @1571860355
Wed, 23 Oct 2019 15:52:35 -0400

What I'd expect to see embedded:

$ TZ=UTC date -R -d @1571860355
Wed, 23 Oct 2019 19:52:35 +0000

And the person who built the initial upload of the software:

$ TZ=CET date -R -d @1571860355
Wed, 23 Oct 2019 21:52:35 +0200

In order to properly support reproducible builds, I believe the localtime should not be used, and times must be converted to UTC time.

Eli Schwartz <eschwartz>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bgarrigues (Updated the item)
  • -email is unavailable- added by eschwartz (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-11-13 bgarrigues Item GroupNone => Build/Installation
        Assigned toNone => bgarrigues

    Back to the top


    Powered by Savane 3.5