[From nobody Tue Nov 3 04:37:07 2026 Received: (at submit) by bugs.debian.org; 28 Oct 2026 23:52:29 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-5.1 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,FREEMAIL_FROM, MD5_SHA1_SUM,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 84; hammy, 150; neutral, 170; spammy, 0. spammytokens: hammytokens:0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--sk:dh_auto, 0.000-+--UD:1-1.dsc, 0.000-+--dpkgsource Return-path: <zloevseth@gmail.com> Received: from mail-vs1-xe35.google.com ([2607:f8b0:4864:20::e35]:61818) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_128_GCM:128) (Exim 4.96) (envelope-from <zloevseth@gmail.com>) id 1xMDRU-00GThr-08 for submit@bugs.debian.org; Wed, 28 Oct 2026 23:52:29 +0000 Received: by mail-vs1-xe35.google.com with SMTP id ada2fe7eead31-7ce645a1c6aso969424137.3 for <submit@bugs.debian.org>; Wed, 28 Oct 2026 16:52:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793231545; cv=none; d=google.com; s=arc-20260327; b=J4Q9wmLUIKVBfz7TOopsx7YAPWdi8UtqEZ3cr1+sZt7cW6M9949J5x4/XkCKFclN0S dBLXiUVy9E18rLDHeQ4iOjWrR7YfNhkdSq+Syo+tnzasaMxbzRE3XTx5dQQSQ14kYYUl LlivxZWm59IoTswXvwWeKRglwzZgn55nWfr4ew8jvh8YH1SvCBdOC6f68o2I7qFOckkM MtdDp/OJlWEiz94XTAvqjHLkIu/UXnm5LfKXGDTIuaS3v0Jy2b43YWQ5Mq2XIf1goHl2 vDtszGMQXZ+i77urGhzM4+s9TFYeyA8tSXtbL+fKOWEvSoPqaLKyvVZ82hYlJahhPmF8 fIVg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=to:subject:message-id:date:from:mime-version:dkim-signature; bh=HI53JSqo2/h/x2zqLtnjYwTH2fQ3FGpgB+JKUCbP6ZI=; fh=lIR/7veID2U00tj1D35G+ANF85YwqTAbTuNH/WGncTs=; b=MdRbFhtXLyXk+v/5mKPM++jjU/RXrgB7mVlFQ7uPE7gg1CuLPsBaEbwcPWD4//gGtH 0TUa1OXe4AUz+ZGsAehx3+wQY1xW/Lg/4n7TfOm8sIODWUK51SYHrf7CSowMhCTb+LHR 0LacTKNz48OMNLr7A3nULBI4RlyyL4gaOP5OKbXeG23t38cY4q5/ifjp0rEgOlaM7r5Y ZYGW932jT9ht2VvTtmzkhpgggqigHXyYaYbpTJ9SObNA9GT9Ng/89oGfjdmlGWO/6V5D NFE+fYv4b7lTqj8B6cvlExG4MTwWZJo4RB56x97LEA1igcVv5I0Pp/xXSlEtHubREify mywQ==; darn=bugs.debian.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793231545; x=1793836345; darn=bugs.debian.org; h=content-type:to:subject:message-id:date:from:mime-version:from:to :cc:subject:date:message-id:reply-to:content-type; bh=HI53JSqo2/h/x2zqLtnjYwTH2fQ3FGpgB+JKUCbP6ZI=; b=XiQvhRDZ5BQvXXnrzaIwqteAuA6OsFIP5vt8l2Qwm0FxNqU5PvvMSE2nXEtOCLwsoz vprYHZUM31Fy83AGjp+qWCtVjZjPKTm80E2W82jxG/hP8fJeFGc3oXRyW/5fBvNTROCw V1yyI8cGOlxE5xjljFSlEbEnQ/GGd4W6rjM3F+I/0APfT42IYuDzxKksFT0pEG+wBASm twBPG2jLa/FbtqgYATjAEa5Phgx6yx6rXfDBOtNMMxGD9lDT0vEIx/AYiOEB3g1s+axc 2oXfx5BQoMM5EYUwW4ANBZSQG+Ya7e9q7gGXfuAv5xCoYxk7m6Itnu8gb4NFG8nmebBn GM5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793231545; x=1793836345; h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=HI53JSqo2/h/x2zqLtnjYwTH2fQ3FGpgB+JKUCbP6ZI=; b=wuzIDBKHDxmqG8DSk7thDxy+9Ry+6q/fsdgdjuloDJ+3RYxzpsoqGtabq4UwDfCbV0 YspBsS1YnQhqcIYQN9mHzsE2l9KQ4EihHVk7x4BxCIUmJVyDToaCjTMRva6tu3/9NTzW mQrYAGDVIMm0ITOESC+SwH4KZcgA/6tYuaaS0dRmSJ5sVfZm6wu+NS57CWX/pCS1SHwb T8BcpdzNkts0m3NUdW8ySFdY1vOLGI+U/dWiFP7/ts4joR91A0TVRff4/sZ37/oepfnL 2OcDvNbQAAiVy/NP1EArC8V2KSB/zoi3nLb02WX5jFFNJIbXX7T8/c6YfunNRur8ivMb XXTA== X-Gm-Message-State: AFq9FYLF/3o1RP4fh2+poHvZDpkDk9/bvk1tdpXelle8bSNQUHsA2uYt 8hhNIdGvyvS7pzWn37lz6IZoDVgddu7Ez0UFnnZAzSreOa1Av8VtZssNxB3EC7uQ7uKawOtNhk4 9EHRFRp300Rd1TyEWpjO6/vYHRVzLklunwPmk X-Gm-Gg: AYBFou0CK+vfpETC9YJCX+eu911bbv0zRxFW7RExWq8ANcX3XyJGqMLuzQS428I+eMy BO3UVPXUl9drz6q/dT7aGRc/tm1UzJpa61u6OIV6Y8rn2o6V7pvUfgqAaBCuXD9fqq026XuFX4Q D3go0y34HOic2WqI0Uxt8Wu3JbGdHZN4Qxxyefuns4mNnC8N82vBnqmRiwsJto+h7fdJDvUc8vb 0G8Hxf8Ahp9PEyqXgeUzYJpnNQxAQt4PlUGAKGR2s38Y2lWfwLtlM4qLvlT/GFtqZboP6LNf6te +e3Bm7pZT3Mu7DQbqkXcqoJ1jQdQEtI/rl4H2w8Kic9bO5CWyRgmo8mO7Pbm1pn6g2bVWYbvrxC gSKMembgY3cv2AAlvJ6ltDgta67qibOwUbCHAcjX3GJiJ+VAlNVf+ISQmhNDSQDhGfhw92hu8rM D/UOUxC5tMI5AlrsGqawxxaxnNaNdqAEdHeGTTU5MLmqhhObFndTKktHYY/klGWWgwDEAxEppPP ruLYYP6AOFMLE/l32zeC36iihic8khf93M36xDkdKIas58y X-Received: by 2002:a05:6102:5106:b0:7cc:115:ddf4 with SMTP id ada2fe7eead31-7d03a4e928cmr2111574137.25.1793231544864; Wed, 28 Oct 2026 16:52:24 -0700 (PDT) Received: from 77377267392 named unknown by gmailapi.google.com with HTTPREST; Wed, 28 Oct 2026 16:52:24 -0700 Received: from 77377267392 named unknown by gmailapi.google.com with HTTPREST; Wed, 28 Oct 2026 16:51:14 -0700 MIME-Version: 1.0 From: Zackary Loevseth <zloevseth@gmail.com> Date: Wed, 28 Oct 2026 16:52:24 -0700 X-Gm-Features: AclHuK9OYPaqT-2fbXtEzRZ2xIdfuyMGc1eqIydtDm30AZXKQ-MuqiV2xREC6j8 Message-ID: <CAE=ZTBjQ+=_ZaCc8MCemhibdTWKf8y7tBSjxZz46-toeamVmtg@mail.gmail.com> Subject: nco: build user and host name embedded in libnco make builds unreproducible To: submit@bugs.debian.org Content-Type: multipart/mixed; boundary="0000000000003b724f065eef413c" Delivered-To: submit@bugs.debian.org --0000000000003b724f065eef413c Content-Type: text/plain; charset="UTF-8" Source: nco Version: 5.4.1-1 Severity: wishlist Tags: patch upstream Forwarded: https://github.com/nco/nco/pull/324 User: reproducible-builds@lists.alioth.debian.org Usertags: hostname username X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org Hi, configure.ac records the build user ($USER, else $LOGNAME) and host name ($HOSTNAME, else $HOST) in config.h, and libnco embeds both: "ncks --version" prints them (the amd64 package in unstable says "built by sbuild on sbuild"), and the grid, skeleton, map, UGRID and TERRAREF writers put the user name in the created_by attribute. A build by another user or on another host therefore produces a different libnco-5.4.1.so. The reproducible-builds CI varies both and lists 5.4.1-1 as unreproducible; its diff shows the two user names and host names in libnco [1]. reproduce.debian.net does rebuild the official amd64 binary bit for bit [2], presumably because its rebuild uses the same "sbuild" names. The .buildinfo records neither value. To reproduce (configure takes both values from the environment when they are set): dpkg-source -x nco_5.4.1-1.dsc && cd nco-5.4.1 USER=alice HOSTNAME=host-a DEB_BUILD_OPTIONS=nocheck dpkg-buildpackage -b -us -uc mv ../nco_5.4.1-1_amd64.deb ../nco-host-a.deb USER=bob HOSTNAME=host-b DEB_BUILD_OPTIONS=nocheck dpkg-buildpackage -b -us -uc cmp ../nco-host-a.deb ../nco_5.4.1-1_amd64.deb What I tested, in a sid chroot (dpkg 1.23.11, debhelper 14.5, autoconf 2.73-2, gcc-16 16.2.0-4), with dpkg-buildpackage run as non-root users and DEB_BUILD_OPTIONS=nocheck: * The commands above: the two packages differ; config.h records alice/host-a and bob/host-b. * Unpatched, changing only USER/LOGNAME (same uid), or only the host name, changes both nco and nco-dbgsym. In nco, the only differing file is usr/lib/nco/libnco-5.4.1.so (and therefore md5sums). * With the attached patch added as debian/patches/<patch> plus a series file, and no other change, two builds from the resulting source package (dpkg-source -b) that differed in user and uid, host name, build path, LANG, time zone (UTC vs UTC+14), parallel= and uname gave identical packages: nco_5.4.1-1_amd64.deb aec58fac88295e44e85a88e76984813e9a7fbd77bfee88acfa144f8b5a65b93d nco-dbgsym_5.4.1-1_amd64.deb a4298c2dc0565a4ab31497dd36eae6a7bde4392cd5df6f20714025b3837fefee dh_autoreconf regenerates configure from the patched configure.ac. Three earlier builds of the same change (it differed only in a code comment), and three with the debian/rules alternative below, gave the same two hashes. * bm/nco_bm.pl --regress against the installed package: 486 tests, 474 pass, 12 fail, with the same per-test results unpatched and patched (the patched run used the byte-identical package from the debian/rules alternative). The patch is the configure.ac change I proposed upstream [3], not yet reviewed there (upstream also gets the regenerated configure; here dh_autoreconf regenerates it). When SOURCE_DATE_EPOCH is set and non-empty, which dpkg-buildpackage ensures, configure records "nobody" and "nowhere" (its existing fallbacks); builds without it are unchanged. Visible effect in the package: "ncks --version" says "built by nobody on nowhere", and created_by becomes "nobody" instead of "sbuild". The patch can be dropped once an upstream release includes it. If you would rather not carry an upstream change, pinning the values in debian/rules gives the same package hashes (tested): override_dh_auto_configure: USER=nobody HOSTNAME=nowhere dh_auto_configure -- \ (existing arguments unchanged) Unexporting USER and HOSTNAME is not enough: configure re-executes itself under bash, which sets HOSTNAME from the system host name when it is not in the environment. [1] https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/nco.html [2] https://reproduce.debian.net/amd64/api/v0/pkgs/list?name=nco (5.4.1-1: GOOD) [3] https://github.com/nco/nco/pull/324 Regards, Zackary Loevseth --0000000000003b724f065eef413c Content-Type: application/octet-stream; name="0001-configure-do-not-record-build-user-and-host-when-SOURCE_DATE_EPOCH-is-set.patch" Content-Disposition: attachment; filename="0001-configure-do-not-record-build-user-and-host-when-SOURCE_DATE_EPOCH-is-set.patch" Content-Transfer-Encoding: base64 X-Attachment-Id: 46fced65241909b6_0.1 RGVzY3JpcHRpb246IGNvbmZpZ3VyZTogZG8gbm90IHJlY29yZCBidWlsZCB1c2VyIGFuZCBob3N0 IHdoZW4gU09VUkNFX0RBVEVfRVBPQ0ggaXMgc2V0CiBjb25maWd1cmUuYWMgcmVjb3JkcyAkVVNF UiAoZWxzZSAkTE9HTkFNRSkgYW5kICRIT1NUTkFNRSAoZWxzZSAkSE9TVCkgb2YKIHRoZSBidWls ZCBtYWNoaW5lIGluIGNvbmZpZy5oLCBhbmQgbGlibmNvIGVtYmVkcyB0aGVtIGluIHRoZSB2ZXJz aW9uCiBiYW5uZXIgYW5kIGluIHRoZSBjcmVhdGVkX2J5IGF0dHJpYnV0ZS4gV2hlbiBTT1VSQ0Vf REFURV9FUE9DSCBpcyBzZXQgYW5kCiBub24tZW1wdHksIGFzIGluIGV2ZXJ5IERlYmlhbiBwYWNr YWdlIGJ1aWxkLCByZWNvcmQgIm5vYm9keSIgYW5kICJub3doZXJlIgogaW5zdGVhZCwgc28gdGhl IGxpYnJhcnkgZG9lcyBub3QgZGVwZW5kIG9uIHdobyBidWlsdCBpdCBvciB3aGVyZS4gQnVpbGRz CiB3aXRob3V0IFNPVVJDRV9EQVRFX0VQT0NIIGFyZSB1bmNoYW5nZWQuCkF1dGhvcjogWmFja2Fy eSBMb2V2c2V0aCA8emxvZXZzZXRoQGdtYWlsLmNvbT4KRm9yd2FyZGVkOiBodHRwczovL2dpdGh1 Yi5jb20vbmNvL25jby9wdWxsLzMyNApMYXN0LVVwZGF0ZTogMjAyNi0xMC0yOAotLS0KLS0tIGEv Y29uZmlndXJlLmFjCisrKyBiL2NvbmZpZ3VyZS5hYwpAQCAtOTAsNyArOTAsMTEgQEAKIEFDX1BS T0dfRUdSRVAKIAogIyBHZXQgaG9zdG5hbWUgYW5kIHVzZXIKLWlmIHRlc3QgIiR7VVNFUn0iOyB0 aGVuCisjIFJlcHJvZHVjaWJsZSBidWlsZHM6IHdpdGggU09VUkNFX0RBVEVfRVBPQ0ggc2V0LCBy ZWNvcmQgIm5vYm9keSIgYW5kCisjICJub3doZXJlIiBpbnN0ZWFkIG9mIHRoZSBidWlsZCB1c2Vy IGFuZCBob3N0CitpZiB0ZXN0IC1uICIke1NPVVJDRV9EQVRFX0VQT0NIfSI7IHRoZW4KKyAgICBu Y29fdXNlcj0ibm9ib2R5IjsKK2VsaWYgdGVzdCAiJHtVU0VSfSI7IHRoZW4KICAgICBuY29fdXNl cj0ke1VTRVJ9OwogZWxpZiB0ZXN0ICIke0xPR05BTUV9IjsgdGhlbgogICAgIG5jb191c2VyPSIk e0xPR05BTUV9IjsKQEAgLTk4LDcgKzEwMiw5IEBACiAgICAgbmNvX3VzZXI9Im5vYm9keSI7CiBm aQogQUNfREVGSU5FX1VOUVVPVEVEKFVTRVIsJHtuY29fdXNlcn0sVXNlcikKLWlmIHRlc3QgIiR7 SE9TVE5BTUV9IjsgdGhlbgoraWYgdGVzdCAtbiAiJHtTT1VSQ0VfREFURV9FUE9DSH0iOyB0aGVu CisgICAgbmNvX2hvc3RuYW1lPSJub3doZXJlIjsKK2VsaWYgdGVzdCAiJHtIT1NUTkFNRX0iOyB0 aGVuCiAgICAgbmNvX2hvc3RuYW1lPSIke0hPU1ROQU1FfSIKICMgZm9sbG93aW5nIGxpbmUgJEhP U1Qgd2lsbCBub3QgYmUgc2V0IChmcm9tIEFDX0NBTk9OSUNBTF9IT1NUIC0gd2lsbCBzZXQgJGhv c3QKIGVsaWYgdGVzdCAiJHtIT1NUfSI7IHRoZW4K --0000000000003b724f065eef413c-- ]