Bug#969320: aflplusplus: please make the build reproducible

[Chris Lamb]

Source: aflplusplus
Version: 2.67c-1
Severity: wishlist
Tags: patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: shell
X-Debbugs-Cc: reproducible-bugs at lists.alioth.debian.org

Hi,

Whilst working on the Reproducible Builds effort [0] we noticed that
aflplusplus could not be built reproducibly.

Here is the variation in the manpage

│ │ │ │ │ -.B afl-clang-fast \- /bin/sh: 1: ./afl-clang-fast: not found
│ │ │ │ │ +.B afl-clang-fast \- /bin/sh: ./afl-clang-fast: No such file or directory

This is, I think, because we do not build or keep these variants on
non-x86 systems, so the call in the Makefile fails with the above
message. This then varies depending on the user's shell that /bin/sh
symlinks to (!), rendering the package reproducible.

Untested patch attached that also removes these manpages from the
binary .deb along with the other deletions in debian/rules, but this may
not be the right approach for your package.

 	cd debian/afl++/usr/bin/ && rm afl-gcc afl-g++
 	cd debian/afl++/usr/lib/afl/ && rm as afl-as
 	cd debian/afl++-clang/usr/bin/ && rm afl-clang afl-clang++
+	cd debian/afl++-clang/usr/share/man/man8 && rm afl-clang-fast.8 afl-clang-fast++.8

There is also a variation in these manpages based on the build date:

│ │ │ │ │ -.TH afl-clang-fast 8 2021-10-03 afl++
│ │ │ │ │ +.TH afl-clang-fast 8 2020-08-31 afl++

... but I can't quite see why as you do appear to be using the
SOURCE_DATE_EPOCH environment variable. It may not matter if we don't
even ship them, hence why I'm not immediately investigating this
angle.

  [0] https://reproducible-builds.org/


Regards,

--
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby at debian.org / chris-lamb.co.uk
       `-
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: aflplusplus.diff.txt
URL: <http://alioth-lists.debian.net/pipermail/reproducible-bugs/attachments/20200831/8d9a09bd/attachment.txt>