Bug#983588: xmlgraphics-commons: reproducible builds: Set timezone to UTC when SOURCE_DATE_EPOCH is set

Vagrant Cascadian vagrant at reproducible-builds.org
Fri Feb 26 19:33:45 GMT 2021


Package: xmlgraphics-commons
Severity: normal
Tags: patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: timestamps timezone toolchain
X-Debbugs-Cc: reproducible-bugs at lists.alioth.debian.org

Several packages use fop (which uses xmlgraphics-commons) to generate
PDF files in Debian packages, but the resulting PDF files have embedding
timestamps. This was partially fixed in fop:

  https://bugs.debian.org/978499


Unfortunately, in some cases the timezone information is still embedded
due to how xmlgraphics-commons embeds the date and timezone:

For example, in xorg-docs:

  https://tests.reproducible-builds.org/debian/rb-pkg/bullseye/amd64/diffoscope-results/xorg-docs.html

  /usr/share/doc/xorg-docs/License.pdf.gz

  dc:date>2020-12-20T04:18:36-12:00
  vs.
  dc:date>2020-12-21T06:18:36+14:00


The attached patch fixes this by adding setting the timezone to UTC when
the SOURCE_DATE_EPOCH environment variable is defined.  This patch is
just a rough draft; would appreciate improvements to it from someone who
knows their way around java better!


This seems to fix the embedded timestamp/timezone issues in several of
the packages listed in:

  https://tests.reproducible-builds.org/debian/issues/unstable/timestamps_in_pdf_generated_by_apache_fop_issue.html


Thanks for maintaining xmlgraphics-commons!


live well,
  vagrant
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-XMPSchemaAdapter.java-Use-UTC-timezone-when-SOURCE_D.patch
Type: text/x-diff
Size: 1506 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-maintainers/attachments/20210226/211c3492/attachment.patch>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-maintainers/attachments/20210226/211c3492/attachment.sig>


More information about the pkg-java-maintainers mailing list