Bug#1121801: in-toto-golang: please make the build reproducible

[Chris Lamb]

Source: in-toto-golang
Version: 0.9.0+ds-4
Severity: wishlist
Tags: patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: nocheck
X-Debbugs-Cc: reproducible-bugs at lists.alioth.debian.org

Hi,

Whilst working on the Reproducible Builds effort [0], we noticed that
in-toto-golang could not be built reproducibly.

This is because the call to remove verifylib_test.go was in the wrong
debian/rules target. Whilst it was in override_dh_auto_test, this target
is not called if the tests are skipped... meaning that if the tests
are *not* run, then the package contains this file.

Patch attached that moves this removal to the (unconditionally run)
execute_after_dh_auto_build target, which also makes the call to
dh_auto_test a little cleaner by not being required.

 [0] https://reproducible-builds.org/


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby at debian.org / chris-lamb.co.uk
       `-
-------------- next part --------------
--- a/debian/rules	2025-12-02 11:35:21.008570260 -0800
--- b/debian/rules	2025-12-02 11:44:47.077356056 -0800
@@ -10,7 +10,7 @@
 override_dh_strip_nondeterminism:
 	dh_strip_nondeterminism -Xfoo.tar.gz
 
-override_dh_auto_test:
+execute_after_dh_auto_build:
 # === RUN   TestInTotoVerifyPass/verifying_with_only_DSSE_metadata
 #     verifylib_test.go:95: layout has expired on '2023-06-03 13:25:20 +0000 UTC'
 # --- FAIL: TestInTotoVerifyPass (0.04s)
@@ -19,4 +19,3 @@
 #     --- FAIL: TestInTotoVerifyPass/verifying_with_only_DSSE_metadata (0.00s)
 # === RUN   TestGetSummaryLink
 	rm -f _build/src/github.com/in-toto/in-toto-golang/in_toto/verifylib_test.go
-	dh_auto_test $(DH_BUILD_OPTS)