[Reproducible-builds] Bug#782878: [debhelper-devel] Bug#782879 + Bug#782878: lib{test-log4perl, scalar-defer}-perl: please make the build reproducible

[Niko Tyni]

(copying Russ, the Pod::Man upstream maintainer)

On Wed, May 20, 2015 at 10:34:20PM +0200, Niels Thykier wrote:
> On 2015-04-19 14:35, gregor herrmann wrote:
> > On Sun, 19 Apr 2015 14:03:44 +0200, Axel Beckert wrote:
> > 
> >> Jelmer Vernooij wrote:
> > 
> >>> +# Set man page timestamp to last package change time.
> >>> +BUILD_DATE = $(shell dpkg-parsechangelog -S Date)
> >>> +POD_MAN_DATE = $(shell date -u +"%Y-%m-%d" --date="$(BUILD_DATE)")
> >>> +export POD_MAN_DATE
> > 
> >> But isn't this something which should be done doing once and properly
> >> in the build system (e.g. in dh_auto_build), like setting all the file
> >> time stamps to that date?

> It is not entirely clear to me what you are asking for.  Is this change
> only supposed to go into a Perl specific build system, in all build
> systems supported by dh_auto_build or ...?

That's a good question. I suppose it should go in all the build systems,
although most of the benefit is certainly for Perl module packages.

The context is that Pod::Man sets the date header based on the
mtime of the file, but if the file is patched by the Debian
packaging, the mtime will be set to the extraction time,
breaking reproducibility.  (See #759404 for some related discussion.)
The mtime will also be unreproducible if the file is generated during
the build.

There are currently at least 400 packages that have Debian patches to
.pm files, which suggests a central fix rather than changing all those
packages.  The obvious options are debhelper and Perl (Pod::Man) itself.

Pod::Man currently supports the POD_MAN_DATE environment variable,
which can be set to an empty string to disable the timestamp
altogether. Globally disabling the date header in Pod::Man would
also affect locally built modules and documentation, which may not be
desirable.  Having debhelper set POD_MAN_DATE would affect only Debian
packages, which would be a less controversial change.

Note that in any case we can't target only the patched/generated files
AFAICS, so we need to remove/reset also all the "reproducible" date
headers that are currently based on stable mtime stamps inside upstream
tarballs. I'm inclined to think this is not a problem, at least as long
as it only appiles to Debian packages (i.e. happens in debhelper rather
than Pod::Man).

Greetings from the Perl team sprint in sunny Barcelona,
-- 
Niko Tyni   ntyni at debian.org