[DRE-maint] Bug#1135269: ruby-timers: please make the build reproducible

[Vagrant Cascadian]

On 2026-09-24, Vagrant Cascadian wrote:
> On 2026-04-30, Chris Lamb wrote:
>> Whilst working on the Reproducible Builds effort [0], we noticed that
>> ruby-timers could not be built reproducibly.
>>
>> This is because the .gemspec file gets evaluated, causing this line:
>>
>>   File.expand_path("~/.gem/release.pem")
>>
>> ... to be rendered in the binary package, leading to the package
>> embedding the build user's home directory.
>>
>> Patch attached.
>
> I can confirm that the patch still applies and fixes the issue.
>
> I would like to perform a Non-Maintainer Upload (NMU) in the coming
> weeks applying this patch.

I have uploaded an NMU to DELAYED/10, debdiff attached. Also prepared a
merge request:

https://salsa.debian.org/ruby-team/ruby-timers/-/merge_requests/1

live well,
  vagrant
-------------- next part --------------
diff -Nru ruby-timers-4.4.0/debian/changelog ruby-timers-4.4.0/debian/changelog
--- ruby-timers-4.4.0/debian/changelog	2026-02-08 18:24:40.000000000 -0800
+++ ruby-timers-4.4.0/debian/changelog	2026-10-14 14:39:23.000000000 -0700
@@ -1,3 +1,13 @@
+ruby-timers (4.4.0-2.1) unstable; urgency=medium
+
+  * Non-maintainer upload.
+
+  [ Chris Lamb ]
+  * debian/patches: timers.gemspec: Drop cert_chain and signing_key for
+    reproducible builds. (Closes: #1135269)
+
+ -- Vagrant Cascadian <vagrant at reproducible-builds.org>  Wed, 14 Oct 2026 14:39:23 -0700
+
 ruby-timers (4.4.0-2) unstable; urgency=medium
 
   * Team upload.
diff -Nru ruby-timers-4.4.0/debian/patches/0001-timers.gemspec-Drop-cert_chain-and-signing_key-for-r.patch ruby-timers-4.4.0/debian/patches/0001-timers.gemspec-Drop-cert_chain-and-signing_key-for-r.patch
--- ruby-timers-4.4.0/debian/patches/0001-timers.gemspec-Drop-cert_chain-and-signing_key-for-r.patch	1969-12-31 16:00:00.000000000 -0800
+++ ruby-timers-4.4.0/debian/patches/0001-timers.gemspec-Drop-cert_chain-and-signing_key-for-r.patch	2026-10-14 14:35:41.000000000 -0700
@@ -0,0 +1,27 @@
+From cd272bbe224bb6a0043b9ac13f36932134bddb74 Mon Sep 17 00:00:00 2001
+From: Chris Lamb <lamby at debian.org>
+Date: Thu, 30 Apr 2026 13:09:31 -0700
+Subject: [PATCH] timers.gemspec: Drop cert_chain and signing_key for
+ reproducible builds. (Closes: #1135269)
+
+---
+ timers.gemspec | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/timers.gemspec b/timers.gemspec
+index c96a9b0..967b2b2 100644
+--- a/timers.gemspec
++++ b/timers.gemspec
+@@ -10,9 +10,6 @@ Gem::Specification.new do |spec|
+ 	spec.authors = ["Tony Arcieri", "Samuel Williams", "Donovan Keme", "Wander Hillen", "Utenmiki", "Jeremy Hinegardner", "Sean Gregory", "Chuck Remes", "Olle Jonsson", "Ron Evans", "Tommy Ong Gia Phu", "Larry Lv", "Lin Jen-Shin", "Ryunosuke Sato", "Atul Bhosale", "Bruno Enten", "Dimitrij Denissenko", "Jesse Cooke", "Klaus Trainer", "Lavir the Whiolet", "Mike Bourgeous", "Nicholas Evans", "Patrik Wenger", "Peter Goldstein", "Ryan LeCompte", "Tim Smith", "V?t Ondruch", "Will Jessop", "Yoshiki Takagi"]
+ 	spec.license = "MIT"
+ 	
+-	spec.cert_chain  = ["release.cert"]
+-	spec.signing_key = File.expand_path("~/.gem/release.pem")
+-	
+ 	spec.homepage = "https://github.com/socketry/timers"
+ 	
+ 	spec.metadata = {
+-- 
+2.47.3
+
diff -Nru ruby-timers-4.4.0/debian/patches/series ruby-timers-4.4.0/debian/patches/series
--- ruby-timers-4.4.0/debian/patches/series	1969-12-31 16:00:00.000000000 -0800
+++ ruby-timers-4.4.0/debian/patches/series	2026-10-14 14:34:54.000000000 -0700
@@ -0,0 +1 @@
+0001-timers.gemspec-Drop-cert_chain-and-signing_key-for-r.patch
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-ruby-extras-maintainers/attachments/20261014/c488d9bd/attachment.sig>