[Reproducible-builds] Bug#794014: moin: please make the build reproducible

[Dhole]

Source: moin
Version: 1.9.8-1
Severity: wishlist
Tags: patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-builds at lists.alioth.debian.org

Hi,

While working on the "reproducible builds" effort [1], we have noticed
that moin could not be built reproducibly.

The attached patch normalizes the timezone and fixes timestamps from the
files compressed with zip to a known value (timestamp from the last
debian/changelg entry). Once applied, moin can be built
reproducibly in our current experimental framework.

 [1]: https://wiki.debian.org/ReproducibleBuilds


Regards,
-- 
Dhole
-------------- next part --------------
diff -Nru moin-1.9.8/debian/changelog moin-1.9.8/debian/changelog
--- moin-1.9.8/debian/changelog	2014-10-19 02:40:50.000000000 +0200
+++ moin-1.9.8/debian/changelog	2015-07-29 16:43:54.000000000 +0200
@@ -1,3 +1,10 @@
+moin (1.9.8-1.1) UNRELEASED; urgency=medium
+
+  * Non-maintainer upload.
+  * Fix timestamps to make package build reproducibly. 
+
+ -- Eduard Sanou <dhole at openmailbox.org>  Wed, 29 Jul 2015 16:43:35 +0200
+
 moin (1.9.8-1) unstable; urgency=medium
 
   * New upstream release, lots of bug fixes
diff -Nru moin-1.9.8/debian/process_language_pages moin-1.9.8/debian/process_language_pages
--- moin-1.9.8/debian/process_language_pages	2014-10-19 01:09:03.000000000 +0200
+++ moin-1.9.8/debian/process_language_pages	2015-07-29 21:48:18.000000000 +0200
@@ -24,7 +24,7 @@
 	echo "Cleaning comments in $f"
 	tmp=`mktemp -d --tmpdir=$BASE` || exit 2
 	cd $tmp
-	unzip -q $f
+	TZ=UTC unzip -q $f
 	chmod a+rw ./*
 	egrep -r -l -Z '^## ' * \
 		| xargs -r -0 -n 1 \
@@ -32,8 +32,11 @@
 		# ^^ search and drop notes in the 8 first lines.
 	chmod a-w ./*
 	chmod a+w MOIN_PACKAGE
+	# Fix files mtime before compressing to get reproducible results.
+	find . -newermt "$(date -u -d @$SOURCE_DATE_EPOCH)" -print0 | \
+		xargs -0r touch --no-dereference --date="$(date -u -d @$SOURCE_DATE_EPOCH)"
 	rm $f
-	zip -q $f *
+	TZ=UTC zip -X -q $f *
 	cd $BASE
 	rm -Rf $tmp
 	COUNT=$(($COUNT + 1))
diff -Nru moin-1.9.8/debian/rules moin-1.9.8/debian/rules
--- moin-1.9.8/debian/rules	2014-10-19 01:09:03.000000000 +0200
+++ moin-1.9.8/debian/rules	2015-07-29 19:00:17.000000000 +0200
@@ -8,6 +8,8 @@
 staticpath := $(shell sed -n -e "s|^\s*release_short\s*=\s*'\([^']*\)'.*|/moin_static\1|p" MoinMoin/version.py)
 $(if $(staticpath),,$(error Failed to resolve staticpath))
 
+export SOURCE_DATE_EPOCH = $(shell date -d "$$(dpkg-parsechangelog --count 1 -SDate)" +%s)
+
 build-arch build-indep: build-stamp
 build-stamp:
 	dh_testdir
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/reproducible-builds/attachments/20150729/1cbbb383/attachment.sig>