[pkg-go] Bug#828994: syncthing: please make the build reproducible

[Dhole]

Source: syncthing 
Version: 0.13.4+dfsg1-1 
Severity: wishlist
Tags: patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: locale
X-Debbugs-Cc: reproducible-builds at lists.alioth.debian.org

Hi,

While working on the "reproducible builds" effort [1], we have noticed
that syncthing could not be built reproducibly.

genassets.go embeds a timestamp of the localtime to a source code file
generated during the build.

The attached patch fixes this replacing the local timestamp by
SOURCE_DATE_EPOCH if defined. Once applied, syncthing can be built
reproducibly in our current experimental framework.

 [1]: https://wiki.debian.org/ReproducibleBuilds

Regards,
-- 
Dhole
-------------- next part --------------
diff -Nru syncthing-0.13.4+dfsg1/debian/changelog syncthing-0.13.4+dfsg1/debian/changelog
--- syncthing-0.13.4+dfsg1/debian/changelog	2016-06-01 16:29:56.000000000 +0200
+++ syncthing-0.13.4+dfsg1/debian/changelog	2016-06-29 15:50:58.000000000 +0200
@@ -1,3 +1,10 @@
+syncthing (0.13.4+dfsg1-1.1) UNRELEASED; urgency=medium
+
+  * Non-maintainer upload.
+  * Use SOURCE_DATE_EPOCH as embedded timestamp by genassets.go if defined.
+
+ -- Eduard Sanou <dhole at openmailbox.org>  Wed, 29 Jun 2016 15:49:38 +0200
+
 syncthing (0.13.4+dfsg1-1) unstable; urgency=medium
 
   * Added missing CC-BY-SA-4.0 section in d/copyright
diff -Nru syncthing-0.13.4+dfsg1/debian/patches/series syncthing-0.13.4+dfsg1/debian/patches/series
--- syncthing-0.13.4+dfsg1/debian/patches/series	2016-06-01 16:29:56.000000000 +0200
+++ syncthing-0.13.4+dfsg1/debian/patches/series	2016-06-29 15:51:12.000000000 +0200
@@ -1,2 +1,3 @@
 use-packaged-gateway.patch
 genxdr-command.patch
+use-SOURCE_DATE_EPOCH.patch
diff -Nru syncthing-0.13.4+dfsg1/debian/patches/use-SOURCE_DATE_EPOCH.patch syncthing-0.13.4+dfsg1/debian/patches/use-SOURCE_DATE_EPOCH.patch
--- syncthing-0.13.4+dfsg1/debian/patches/use-SOURCE_DATE_EPOCH.patch	1970-01-01 01:00:00.000000000 +0100
+++ syncthing-0.13.4+dfsg1/debian/patches/use-SOURCE_DATE_EPOCH.patch	2016-06-29 15:52:18.000000000 +0200
@@ -0,0 +1,46 @@
+Description: Use SOURCE_DATE_EPOCH in genassets.go
+ Use SOURCE_DATE_EPOCH if defined as the embedded timestamp by genassets.go to
+ make the generated file reproducible.
+Author: Eduard Sanou <dhole at openmailbox.org>
+
+--- syncthing-0.13.4+dfsg1.orig/script/genassets.go
++++ syncthing-0.13.4+dfsg1/script/genassets.go
+@@ -13,11 +13,13 @@ import (
+ 	"compress/gzip"
+ 	"encoding/base64"
+ 	"flag"
++	"fmt"
+ 	"go/format"
+ 	"io"
+ 	"net/http"
+ 	"os"
+ 	"path/filepath"
++	"strconv"
+ 	"strings"
+ 	"text/template"
+ 	"time"
+@@ -93,10 +95,23 @@ func main() {
+ 	flag.Parse()
+ 
+ 	filepath.Walk(flag.Arg(0), walkerFor(flag.Arg(0)))
++
++	source_date_epoch := os.Getenv("SOURCE_DATE_EPOCH")
++	var build_date string
++	if source_date_epoch == "" {
++		build_date = time.Now().UTC().Format(http.TimeFormat)
++	} else {
++		sde, err := strconv.ParseInt(source_date_epoch, 10, 64)
++		if err != nil {
++			panic(fmt.Sprintf("Invalid SOURCE_DATE_EPOCH: %s", err))
++		}
++		build_date = time.Unix(sde, 0).UTC().Format(http.TimeFormat)
++	}
++
+ 	var buf bytes.Buffer
+ 	tpl.Execute(&buf, templateVars{
+ 		Assets:    assets,
+-		BuildDate: time.Now().UTC().Format(http.TimeFormat),
++		BuildDate: build_date,
+ 	})
+ 	bs, err := format.Source(buf.Bytes())
+ 	if err != nil {
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 455 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-go-maintainers/attachments/20160629/81f004f0/attachment.sig>