Bug#996572: gcc-arm-none-eabi: reproducible builds: source tarball includes non-deterministic files

[Vagrant Cascadian]

Source: gcc-arm-none-eabi
Severity: normal
Tags: patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: randomness username timestamps fileordering
X-Debbugs-Cc: reproducible-bugs at lists.alioth.debian.org

The file /autom4te.cache/requests includes non-deterministic ordering,
and is shipped inside /usr/src/gcc-arm-none-eabi-source.tar.xz

  https://tests.reproducible-builds.org/debian/rb-pkg/bookworm/amd64/diffoscope-results/gcc-arm-none-eabi.html

Patch to debian/rules attached which excludes autom4ate.cache from the
tarball, as well as sorting by name, set the user and group ids, and
setting the timestamp using SOURCE_DATE_EPOCH. These additional
normalizations will be needed if Rules-Requires-Root is ever enabled.

It might be worth considering excluding .pc from the tarball as well;
though this isn't strictly necessary for reproducible builds.


This patch alone does not fix all reproducibility issues (e.g. build
paths, which are only tested on unstable and experimental), but with the
patch from #996194 applied, this should become reproducible once it
migrates to bookworm.


Thanks for maintaining gcc-arm-none-eabi!


live well,
  vagrant
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-debian-rules-Generate-tarball-reproducibly.patch
Type: text/x-diff
Size: 1277 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/reproducible-bugs/attachments/20211015/a93e84f5/attachment.patch>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/reproducible-bugs/attachments/20211015/a93e84f5/attachment.sig>