[DRE-maint] Bug#1135269: ruby-timers: please make the build reproducible

[Vagrant Cascadian]

On 2026-04-30, Chris Lamb wrote:
> Whilst working on the Reproducible Builds effort [0], we noticed that
> ruby-timers could not be built reproducibly.
>
> This is because the .gemspec file gets evaluated, causing this line:
>
>   File.expand_path("~/.gem/release.pem")
>
> ... to be rendered in the binary package, leading to the package
> embedding the build user's home directory.
>
> Patch attached.

I can confirm that the patch still applies and fixes the issue.

I would like to perform a Non-Maintainer Upload (NMU) in the coming
weeks applying this patch.

Are there any outstanding concerns?

live well,
  vagrant

> --- a/debian/patches/reproducible-build.patch	1969-12-31 16:00:00.000000000 -0800
> --- b/debian/patches/reproducible-build.patch	2026-04-30 04:37:52.593631918 -0700
> @@ -0,0 +1,16 @@
> +Description: Make the build reproducible
> +Author: Chris Lamb <lamby at debian.org>
> +Last-Update: 2026-04-30
> +
> +--- ruby-timers-4.4.0.orig/timers.gemspec
> ++++ ruby-timers-4.4.0/timers.gemspec
> +@@ -10,9 +10,6 @@ Gem::Specification.new do |spec|
> + 	spec.authors = ["Tony Arcieri", "Samuel Williams", "Donovan Keme", "Wander Hillen", "Utenmiki", "Jeremy Hinegardner", "Sean Gregory", "Chuck Remes", "Olle Jonsson", "Ron Evans", "Tommy Ong Gia Phu", "Larry Lv", "Lin Jen-Shin", "Ryunosuke Sato", "Atul Bhosale", "Bruno Enten", "Dimitrij Denissenko", "Jesse Cooke", "Klaus Trainer", "Lavir the Whiolet", "Mike Bourgeous", "Nicholas Evans", "Patrik Wenger", "Peter Goldstein", "Ryan LeCompte", "Tim Smith", "Vt Ondruch", "Will Jessop", "Yoshiki Takagi"]
> + 	spec.license = "MIT"
> + 	
> +-	spec.cert_chain  = ["release.cert"]
> +-	spec.signing_key = File.expand_path("~/.gem/release.pem")
> +-	
> + 	spec.homepage = "https://github.com/socketry/timers"
> + 	
> + 	spec.metadata = {
> --- a/debian/patches/series	1969-12-31 16:00:00.000000000 -0800
> --- b/debian/patches/series	2026-04-30 04:37:51.255121707 -0700
> @@ -0,0 +1 @@
> +reproducible-build.patch
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-ruby-extras-maintainers/attachments/20260924/d14c635b/attachment-0001.sig>