From aurel32 at debian.org Sun May 25 15:12:51 2025 From: aurel32 at debian.org (Aurelien Jarno) Date: Sun, 25 May 2025 16:12:51 +0200 Subject: Bug#1106526: nmu: multiple binNMUs to fix build reproducibility Message-ID: <174818237135.3084027.15861671958253210668.reportbug@ohm.local> Package: release.debian.org Severity: normal X-Debbugs-Cc: reproducible-bugs at lists.alioth.debian.org User: release.debian.org at packages.debian.org Usertags: binnmu Dear release team, Reproducible builds are based on the assumption that the build date is always newer than the latest changelog entry. Unfortunately some source packages recently got uploaded from a computer with the wrong time, causing the binary packages in the archive to not be reproducible, as this can be checked on reproduce.debian.net. They however appear as reproducible on tests.reproducible-builds.org as instead of comparing a new build to the version in the archive, it does two new builds and check they matches. After doing a full check of the testing suite, I have found that this problem actually existed for other packages. Here is a list of binNMUs to fix many of them: nmu baobab_48.0-2 . ANY . -m 'Rebuild to fix reproducibility' nmu clapper_0.8.0-2 . ANY . -m 'Rebuild to fix reproducibility' nmu deja-dup_45.2-3 . ANY . -m 'Rebuild to fix reproducibility' nmu five-or-more_1:48.1-2 . ANY . -m 'Rebuild to fix reproducibility' nmu gnome-2048_3.38.2-5 . ANY . -m 'Rebuild to fix reproducibility' nmu gnome-boxes_48.0-3 . ANY . -m 'Rebuild to fix reproducibility' nmu gnome-builder_48.0-2 . ANY . -m 'Rebuild to fix reproducibility' nmu gnome-calculator_1:48.1-2 . ANY . -m 'Rebuild to fix reproducibility' nmu gnome-calendar_48.1-2 . ANY . -m 'Rebuild to fix reproducibility' nmu gnome-clocks_48.0-2 . ANY . -m 'Rebuild to fix reproducibility' nmu gnome-commander_1.18.2-2 . ANY . -m 'Rebuild to fix reproducibility' nmu gnome-connections_48.0-2 . ANY . -m 'Rebuild to fix reproducibility' nmu gnome-console_48.0.1-2 . ANY . -m 'Rebuild to fix reproducibility' nmu gnome-contacts_48.0-2 . ANY . -m 'Rebuild to fix reproducibility' nmu gnome-disk-utility_46.1-2 . ANY . -m 'Rebuild to fix reproducibility' nmu gnome-font-viewer_48.0-2 . ANY . -m 'Rebuild to fix reproducibility' nmu gnome-klotski_1:3.38.2-4 . ANY . -m 'Rebuild to fix reproducibility' nmu gnome-mahjongg_1:48.1-2 . ANY . -m 'Rebuild to fix reproducibility' nmu gnome-mines_1:48.1-2 . ANY . -m 'Rebuild to fix reproducibility' nmu gnome-multi-writer_3.32.1-4 . ANY . -m 'Rebuild to fix reproducibility' nmu gnome-power-manager_43.0-4 . ANY . -m 'Rebuild to fix reproducibility' nmu tiptop_2.3.1-5 . amd64 armel armhf i386 mips64el ppc64el s390x m68k powerpc ppc64 sh4 sparc64 x32 . -m 'Rebuild to fix reproducibility' Unfortunately some others will require a sourceful upload as they include one or more arch:all packages. Regards Aurelien From aurel32 at debian.org Sun May 25 15:34:40 2025 From: aurel32 at debian.org (Aurelien Jarno) Date: Sun, 25 May 2025 16:34:40 +0200 Subject: nmu: multiple binNMUs to fix build reproducibility In-Reply-To: <174818237135.3084027.15861671958253210668.reportbug@ohm.local> References: <174818237135.3084027.15861671958253210668.reportbug@ohm.local> Message-ID: Hi, On 2025-05-25 16:12, Aurelien Jarno wrote: > Reproducible builds are based on the assumption that the build date is > always newer than the latest changelog entry. > > Unfortunately some source packages recently got uploaded from a computer > with the wrong time, causing the binary packages in the archive to not > be reproducible, as this can be checked on reproduce.debian.net. They > however appear as reproducible on tests.reproducible-builds.org as > instead of comparing a new build to the version in the archive, it does > two new builds and check they matches. > > After doing a full check of the testing suite, I have found that this > problem actually existed for other packages. Here is a list of binNMUs > to fix many of them: [ snip ] > Unfortunately some others will require a sourceful upload as they > include one or more arch:all packages. I someone is interested by fixing those (I guess by doing a no change source upload, and then asking the release team for an unblock), here is the list. On my side I am not sure to have the spoons for that. bluebrain-hpc-coding-conventions_1.0.0+git20221201-2 cheese_44.1-5 d-spy_48.0-3 epiphany-browser_48.3-2 fonts-inconsolata_001.010-6 foomatic-db_20230202-1 gedit_48.1-4 golang-github-apparentlymart-go-dump_0.0~git20190214.042adf3-3 golang-gopkg-mail.v2_2.3.1-2 libmessage-passing-perl_0.117-1 libwww-indexparser-perl_0.91-2 pocsuite3_2.0.3-1 python-pbs-installer_2025.04.09-1 referencing_0.36.2-1 In addition gimp_3.0.2-3 is already fixed in sid, but it requires an unblock from the release team. Regards Aurelien -- Aurelien Jarno GPG: 4096R/1DDD8C9B aurelien at aurel32.net http://aurel32.net