[Reproducible-builds] Bug#793680: libdevice-cdio-perl: please ensure that package is always built from source

[Chris Lamb]

Source: libdevice-cdio-perl
Version: 0.3.0-4
Severity: wishlist
Tags: patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-builds at lists.alioth.debian.org

Hi,

While working on the "reproducible builds" effort [1], we have noticed
that libdevice-cdio-perl could not be built reproducibly, but more
crucially that the files generated by SWIG are non-deterministically
re-generated (or not).

This is problematic as Debian packages should. of course, be generated
from the provided sources, at least so that modifying the source will
result in a modified binary.

The files in question are lib/perl*.pm. This was detected because SWIG
was adding a "generated by version X", where X appears to flap between
the generated versions of the file shipped with libdevice-cdio-perl (as
it happens, version 1.3.40) and the current version of SWIG in unstable
(at the time of writing, 2.0.12)

Here's one way of solving the problem:

    override_dh_auto_clean:
           	rm -f lib/perl*.pm
           	dh_auto_clean

.. but I wonder if this is a deeper problem with Module::Build and thus
affecting the entire archive. For this reason, I have avoided the
"patch"
tag. Hopefully, someone with more knowledge will be able to tell the
impact.

 [1]: https://wiki.debian.org/ReproducibleBuilds


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby at debian.org / chris-lamb.co.uk
       `-