Bug#1063939: different timezones produce different pdf /ID with equal SOURCE_DATE_EPOCH

[Johannes Schauer Marin Rodrigues]

Source: fop
Version: 1:2.8-2
Severity: normal
Tags: patch
X-Debbugs-Cc: reproducible-bugs at lists.alioth.debian.org
User: reproducible-builds at lists.alioth.debian.org
Usertags: timezones

Hi,

even when keeping SOURCE_DATE_EPOCH equal, varying the timezone via the TZ
environment variable produces different PDFs when using fop. Specifically,
their /ID differs. Here is some reprotest output that shows the issue:

https://salsa.debian.org/debian/xmlstarlet/-/jobs/5296216

To reproduce, you can run this in the xmlstarlet source:

TZ=GMT-1 SOURCE_DATE_EPOCH=0 /usr/bin/fop -q doc/xmlstarlet-ug.fo doc/xmlstarlet-ug.pdf
TZ=GMT+1 SOURCE_DATE_EPOCH=0 /usr/bin/fop -q doc/xmlstarlet-ug.fo doc/xmlstarlet-ug.pdf

The reason is, that generateFileID() uses SimpleDateFormat().format() which is
not timezone aware and will use the current timezone for the string it
produces. My patch replaces that for DateFormatUtil.formatPDFDate() with UTC:

https://salsa.debian.org/java-team/fop/-/merge_requests/2

Thanks!

cheers, josch