Bug#983588: xmlgraphics-commons: reproducible builds: Set timezone to UTC when SOURCE_DATE_EPOCH is set

[Vagrant Cascadian]

On 2021-02-26, Vagrant Cascadian wrote:
> Several packages use fop (which uses xmlgraphics-commons) to generate
> PDF files in Debian packages, but the resulting PDF files have embedding
> timestamps. This was partially fixed in fop:
>
>   https://bugs.debian.org/978499
>
>
> Unfortunately, in some cases the timezone information is still embedded
> due to how xmlgraphics-commons embeds the date and timezone:
...
> The attached patch fixes this by adding setting the timezone to UTC when
> the SOURCE_DATE_EPOCH environment variable is defined.  This patch is
> just a rough draft; would appreciate improvements to it from someone who
> knows their way around java better!
>
>
> This seems to fix the embedded timestamp/timezone issues in several of
> the packages listed in:
>
>   https://tests.reproducible-builds.org/debian/issues/unstable/timestamps_in_pdf_generated_by_apache_fop_issue.html

This should fix reproducibility issues in several other packages; is
there anything else I can do to help getting this fix into Debian?


live well,
  vagrant

> From 2146f4a44fbee1e3aef12e56ae3d904e793090cd Mon Sep 17 00:00:00 2001
> From: Vagrant Cascadian <vagrant at reproducible-builds.org>
> Date: Fri, 26 Feb 2021 19:10:10 +0000
> Subject: [PATCH] XMPSchemaAdapter.java: Use UTC timezone when
>  SOURCE_DATE_EPOCH is set.
>
> SOURCE_DATE_EPOCH specifies the timestamp, but needs to be rendered in
> UTC timezone to ensure reproducible builds.
>
> https://reproducible-builds.org/docs/source-date-epoch/
>
> This is a follow-up to https://bugs.debian.org/978499 in apache fop,
> as there is no way for fop itself to pass the timezone information for
> some values.
> ---
>  .../java/org/apache/xmlgraphics/xmp/XMPSchemaAdapter.java    | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/src/main/java/org/apache/xmlgraphics/xmp/XMPSchemaAdapter.java b/src/main/java/org/apache/xmlgraphics/xmp/XMPSchemaAdapter.java
> index 9a41eba..19811a8 100644
> --- a/src/main/java/org/apache/xmlgraphics/xmp/XMPSchemaAdapter.java
> +++ b/src/main/java/org/apache/xmlgraphics/xmp/XMPSchemaAdapter.java
> @@ -157,6 +157,11 @@ public class XMPSchemaAdapter {
>       * @return the formatted date
>       */
>      public static String formatISO8601Date(Date dt) {
> +        // https://reproducible-builds.org/docs/source-date-epoch/
> +        String source_date_epoch = System.getenv("SOURCE_DATE_EPOCH");
> +        if (source_date_epoch != null) {
> +            return formatISO8601Date(dt, TimeZone.getTimeZone("Etc/UTC"));
> +        }
>          return formatISO8601Date(dt, TimeZone.getDefault());
>      }
>  
> -- 
> 2.20.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-maintainers/attachments/20211008/0578e163/attachment-0001.sig>