Bug#958301: dh-cargo: please make the output reproducible

[Chris Lamb]

Source: dh-cargo
Version: 23
Severity: wishlist
Tags: patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: buildpath toolchain
X-Debbugs-Cc: reproducible-bugs at lists.alioth.debian.org

Hi,

Whilst working on the Reproducible Builds effort [0] we noticed that
dh-cargo generates/installs non-reproducible output. For example,
here is rust-difference 2.0.0-1:

│ │ │ ├── ./usr/.crates2.json
│ │ │ │ │ @@ -1,10 +1,10 @@
│ │ │ │ │  {
│ │ │ │ │      "installs": {
│ │ │ │ │ -        "difference 2.0.0 (path+file:///build/1st/rust-difference-2.0.0)": {
│ │ │ │ │ +        "difference 2.0.0 (path+file:///build/2/rust-difference-2.0.0/2nd)": {

Proof-of-concept patch attached that strips all these files. It might
be better to do this elsewhere, up to you.

  --- a/cargo.pm
  +++ b/cargo.pm
  @@ -170,6 +170,7 @@ sub install {
           my $destdir = $ENV{'DESTDIR'} || $this->get_sourcepath("debian/" . $this->{binpkg});
           doit("env", "DESTDIR=$destdir",
                "/usr/share/cargo/bin/cargo", "install", @_);
  +        doit('find', $destdir, '-name', '.crates2.json', '-exec', 'rm', '{}', '+');
           # generate Built-Using fields         

Note that this file is being installed to /usr (!) which is likely a
pretty severe bug here or in rust-difference, but I'll leave that
with you.


  [0] https://reproducible-builds.org/


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby at debian.org / chris-lamb.co.uk
       `-
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: dh-cargo.diff.txt
URL: <http://alioth-lists.debian.net/pipermail/reproducible-bugs/attachments/20200420/54dbba55/attachment.txt>