[Pkg-rust-maintainers] Bug#1121799: Bug#1121799: rust-doxx: please make the build reproducible

[Fabian Grünbichler]

Control: clone -1 -2
Control: reassign -2 dh-cargo
Control: retitle -2 dh-cargo: try harder to install unmodified source

On Tue, Dec 2, 2025, at 11:28 PM, Chris Lamb wrote:
> Source: rust-doxx
> Version: 0.1.2-1
> Severity: wishlist
> Tags: patch
> User: reproducible-builds at lists.alioth.debian.org
> Usertags: nocheck
> X-Debbugs-Cc: reproducible-bugs at lists.alioth.debian.org
>
> Hi,
>
> Whilst working on the Reproducible Builds effort [0], we noticed that
> rust-doxx could not be built reproducibly.
>
> This is because the tests cause a Cargo.lock file to be created, which
> end up in the binary package, but only if the tests are run.

thanks! this is actually an issue with dh-cargo, because it will try to
install the sources in dh_auto_install, but doesn't know about all
potential modifications done by dh_auto_configure/build/test which run
before.

some possible solutions:
- cp to a tmp directory early on (e.g., during dh_auto_build), and to the
  final location in dh_auto_install
- create a tarball early on (... like copying above)
- use `cargo package` as intermediate format (this is actually generating
  a tarball, and is the first step of publishing on crates.io), extract
  during install (has other side-effects though, including newer cargo
  potentially behaving differently)