[From nobody Mon Nov 2 21:07:06 2026 Received: (at submit) by bugs.debian.org; 1 Nov 2026 01:03:14 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-20.2 required=4.0 tests=BAYES_00, BODY_INCLUDES_PACKAGE,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU, DKIM_VALID_EF,HAS_PACKAGE,PGPSIGNATURE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 63; hammy, 150; neutral, 86; spammy, 0. spammytokens: hammytokens:0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--H*ct:application, 0.000-+--H*ct:protocol, 0.000-+--H*ct:micalg Return-path: <vagrant@reproducible-builds.org> Received: from cascadia.aikidev.net ([2600:3c01:e000:267:0:a171:de7:c]:33972) by buxtehude.debian.org with utf8esmtps (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <vagrant@reproducible-builds.org>) id 1xNJyb-009TCw-1U for submit@bugs.debian.org; Sun, 01 Nov 2026 01:03:14 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=reproducible-builds.org; s=1.vagrant; t=1793494991; bh=BtFq7OGFnyg7hvQqu+Tsjf70Ik02+fI14bI8Gx7iP8U=; h=From:To:Subject:Date:From; b=16xYcahgzhYnreEes2vH1hnM7KzJsGrUrl25MPfmjTbe+zdrOjcX6zTlcamIAQIEc j4lcCkPl5AL09GyakDH0+MamdYjqOD3Y9V9OjcKpe05Uix8ud6/9yRL91nwLUYN9J9 GfkaZb1zf8zdj0ytjLqCQap707B6K9RMkI63aW/UfXRdZjLguM3TZLTQs/I7Y3KLU/ kypLaZ3MzBG1RZ2cclb8J6hJSamVyT2pcZ+rpc1oFgYR6Kf0DnalXokO3lY0TCnT76 tiOPXr6TmNMqDtQpv/3X/aAG2TgncbodHUP7LFHnaf65h9BrS1ZJl1L+g+lg0PKyQL cJyx988yvYaKw== Received: from localhost (unknown [IPv6:2600:3c01:e000:21:7:77:0:50]) by cascadia.aikidev.net (Postfix) with UTF8SMTPSA id 26893E1F2 for <submit@bugs.debian.org>; Sat, 31 Oct 2026 18:03:11 -0700 (PDT) From: Vagrant Cascadian <vagrant@reproducible-builds.org> To: submit@bugs.debian.org Subject: fop: reproducible builds: Improve use of SOURCE_DATE_EPOCH for timestamps in PDF files Date: Sat, 31 Oct 2026 18:03:05 -0700 Message-ID: <87wlqx5po6.fsf@wireframe> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Delivered-To: submit@bugs.debian.org --=-=-= Content-Type: text/plain Package: fop Severity: normal Tags: patch User: reproducible-builds@lists.alioth.debian.org Usertags: timestamps toolchain X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org, tony mancill <tmancill@debian.org> I think I found one of the remaining places where timestamps were sneaking into CreateDate when using fop to generate PDFs. If this sounds familiar, that is because this is a follow-up to the original bug which partially fixed the issues: https://bugs.debian.org/978499 It has been nagging at me in the 5 or so years since; I think I finally identified where in the code needs to be adjusted! This patch is more of a proof-of-concept than a real patch, although it did appear to fix the one remaining issue for the pam and treeview packages. diff --git a/fop-core/src/main/java/org/apache/fop/render/intermediate/IFRenderer.java b/fop-core/src/main/java/org/apache/fop/render/intermediate/IFRenderer.java index 84e4e3a..a4d8d7c 100644 --- a/fop-core/src/main/java/org/apache/fop/render/intermediate/IFRenderer.java +++ b/fop-core/src/main/java/org/apache/fop/render/intermediate/IFRenderer.java @@ -544,7 +544,8 @@ public class IFRenderer extends AbstractPathOrientedRenderer { } else { xmpBasic.setCreatorTool(Version.getVersion()); } - xmpBasic.setMetadataDate(new java.util.Date()); + final Long sourcedate = (1000 * Long.parseLong("1793491658")); + xmpBasic.setMetadataDate(new java.util.Date(sourcedate)); if (getUserAgent().getCreationDate() != null) { xmpBasic.setCreateDate(getUserAgent().getCreationDate()); } else { Obviously hard-coding this is the wrong way to fix this (well, it is reproducible!), but adjusting it to use SOURCE_DATE_EPOCH like in the earlier debian/patches/0001-PDFInfo.java-Support-SOURCE_DATE_EPOCH-environment-v.patch should hopefully do the trick? I struggle a bit with the Java code necessary to pull this off myself, but at least identified *where* in the code it needed to be fixed. Other packages using fop to generate PDFs seem to mostly be working even without this: https://tests.reproducible-builds.org/debian/issues/unstable/timestamps_in_pdf_generated_by_apache_fop_issue.html live well, vagrant --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCauaPyQAKCRDcUY/If5cW qm04APsE9PviXSHURwBO9JTWhCNGFeRx9etEGHBu2FuYjEn2dgEAgF1Ga4nThesu rFKhym+3iKHEnNDx2+S2bnX/FaLKqAA= =Sy6t -----END PGP SIGNATURE----- --=-=-=-- ]