[Reproducible-builds] Bug#774422: perl: please make perl builds reproducible

[Niko Tyni]

On Fri, Jan 02, 2015 at 02:38:37PM +0100, Jérémy Bobbio wrote:
> Source: perl
> Version: 5.20.1-4
> Severity: wishlist
> Tags: patch
> User: reproducible-builds at lists.alioth.debian.org
> Usertags: timestamps fileordering

> The attached patches will fix that with our current experimental
> framework. I hope the description of each patch is enough to understand
> their purpose.

Thanks, this is awesome! I only had a quick look so just a couple of
notes and questions for now.

> Subject: [PATCH] Fix mtimes before building binary packages
> 
> To enable perl to build reproducibly, mtimes of any files created
> after the date of the latest debian/changelog entry will be changed to
> that date.

Is this because of the date header in manpages? Setting the POD_MAN_DATE
environment variable could/should suffice for that, I think. See
debian/patches/fixes/pod_man_reproducible_date.diff

> Subject: [PATCH] Stop recording build date and time
> 
> In order to make the package build reproducibly, we remove the
> recording of the build date and time. This was already optional
> in case the __DATE__ C pre-processor macro was not available.

I expect this needs to be made configurable for upstream to accept
it. Also, it might be safer to replace __DATE__ and __TIME__ with
some placeholders rather than dropping them, at least until this is
upstreamed. There might well be some crazy things parsing 'perl -V'
output or something like that which could choke if the lines are left
out altogether.

> Subject: [PATCH] Create libperl.a using deterministic mode
> 
> In order to make Perl builds reproducible, create libperl.a using ar
> in deterministic mode.

This patch was duplicated in your mail: first

> -	$(AR) rcu $(LIBPERL) $(obj) $(DYNALOADER)
> +	$(AR) Drcu $(LIBPERL) $(obj) $(DYNALOADER)

and later

> -	$(AR) rcu $(LIBPERL) $(obj) $(DYNALOADER)
> +	$(AR) Drc $(LIBPERL) $(obj) $(DYNALOADER)

I assume the first is the correct one.
 
> Subject: [PATCH] Set mtime of patchlevel.h to highest mtime of Debian patches
> 
> $patchlevel_date in perlbug is determined by looking at patchlevel.h mtime.
> In order to make Perl builds reproducible, we thus set this value to
> the highest mtime of all the Debian patches.
> ---
>  debian/gen-patchlevel | 10 ++++++++++

Not sure the 'touch' part belongs in gen-patchlevel, which currently
just prints to STDOUT. But I can see it would be nice to pick up the
mtime while reading the patches anyway. I wonder if we could/should
use the changelog date instead, though. The whole thing of writing
$patchlevel_date into perlbug to see how old this perl is feels weird...
-- 
Niko Tyni   ntyni at debian.org