Bug#978499: #978499: fop: reproducible builds: Support using SOURCE_DATE_EPOCH for timestamps in PDF files

[Vagrant Cascadian]

Control: notfixed 978499 1:2.5-2

On 2020-12-27, Vagrant Cascadian wrote:
> Several packages use fop to generate PDF files in Debian packages, but
> the resulting PDF files have embedding timestamp information in the
> CreationDate of the PDF:
>
>   https://tests.reproducible-builds.org/debian/issues/unstable/timestamps_in_pdf_generated_by_apache_fop_issue.html

Thanks for the quick upload! unfortunately...


> For example, in xorg-docs:
>
>   https://tests.reproducible-builds.org/debian/rb-pkg/bullseye/amd64/diffoscope-results/xorg-docs.html
>
>   /usr/share/doc/xorg-docs/xlfd/xlfd.pdf.gz
>   
>   CreationDate:·"D:20201225182038-12'00'"
>   vs.
>   CreationDate:·"D:20220129025203+14'00'"

I rescheduled various builds after fop landed in unstable, and it
appears to not fully fix the issue...

It clearly fixed the issue for me when building xorg-docs with reprotest
locally, which does test time and timezone variations... but it uses
faketime, which often behaves differently than a system with an adjusted
running clock such as the tests.reproducible-builds.org infrastructure.

hrm.


> The attached patch fixes this by adding support for the
> SOURCE_DATE_EPOCH environment variable to fop, which embeds the
> specified timestamp rather than the current time:
>
>   https://reproducible-builds.org/docs/source-date-epoch/
>
>
> Thanks for maintaining fop!
>
>
> live well,
>   vagrant
> From 25826ea9c86d01a8392cf593b9aa93c72b469b19 Mon Sep 17 00:00:00 2001
> From: Vagrant Cascadian <vagrant at reproducible-builds.org>
> Date: Mon, 28 Dec 2020 02:48:21 +0000
> Subject: [PATCH] PDFInfo.java: Support SOURCE_DATE_EPOCH environment variable.
>
> https://reproducible-builds.org/docs/source-date-epoch/
> ---
>  fop-core/src/main/java/org/apache/fop/pdf/PDFInfo.java | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/fop-core/src/main/java/org/apache/fop/pdf/PDFInfo.java b/fop-core/src/main/java/org/apache/fop/pdf/PDFInfo.java
> index 3aa5d97..79f3f42 100644
> --- a/fop-core/src/main/java/org/apache/fop/pdf/PDFInfo.java
> +++ b/fop-core/src/main/java/org/apache/fop/pdf/PDFInfo.java
> @@ -305,7 +305,14 @@ public class PDFInfo extends PDFObject {
>       * @return the requested String representation
>       */
>      protected static String formatDateTime(final Date time) {
> -        return formatDateTime(time, TimeZone.getDefault());
> +        // https://reproducible-builds.org/docs/source-date-epoch/
> +        String source_date_epoch = System.getenv("SOURCE_DATE_EPOCH");
> +        if (source_date_epoch != null) {
> +            Long sourcedate = (1000 * Long.parseLong(source_date_epoch));
> +            return formatDateTime(new Date(sourcedate), TimeZone.getTimeZone("Etc/UTC"));
> +        } else {
> +            return formatDateTime(time, TimeZone.getDefault());
> +        }
>      }
>  
>      /**
> -- 
> 2.20.1


Ah well, if anyone has a suggestion for how to really fix it, that would
be nice, since it would fix several packages...


live well,
  vagrant
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-maintainers/attachments/20201229/c26e6673/attachment.sig>