Bug#978946: gfxboot: reproducible builds: Embeds user id and group id in cpio files

[Vagrant Cascadian]

Source: gfxboot
Severity: normal
Tags: patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: username
X-Debbugs-Cc: reproducible-bugs at lists.alioth.debian.org

Various cpio archives shipped in gfxboot contain the user id and group
id of the build user:

  https://tests.reproducible-builds.org/debian/rb-pkg/bullseye/amd64/diffoscope-results/gfxboot.html

  etc/bootsplash/example_01/cdrom/bootlogo

  -rw-r--r--···1·····1111·····1111····42639·2020-12-24·13:17:48.000000·init
  vs.
  -rw-r--r--···1·····2222·····2222····42639·2022-01-26·19:45:05.000000·init


The attached patch fixes this by passing the owner argument to the cpio
calls when creating the archives.


Unfortunately, the cpio archives also embed the timestamps of the files
included, which will likely vary between builds, so this does not
resolve all reproducibility issues with these archives.


Thanks for maintaining gfxboot!


live well,
  vagrant
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Patch-calls-to-create-cpio-archives-to-set-owner-and.patch
Type: text/x-diff
Size: 2511 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/reproducible-bugs/attachments/20201231/7540fa86/attachment.patch>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/reproducible-bugs/attachments/20201231/7540fa86/attachment.sig>