[Reproducible-builds] Bug#797211: apt-dater: incorrect usage of SOURCE_DATE_EPOCH renders package unreproducible

[Chris Lamb]

Source: apt-dater
Version: 1.0.2-1
Severity: wishlist
Tags: patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-builds at lists.alioth.debian.org

Hi,

There are two issues with the handling of SOURCE_DATE_EPOCH that
cause this package to remain reproducible:

 * Missing LC_ALL=C (or LC_TIME, etc.) in src/Makefile.am
   otherwise the formatted string is translated to the current
   locale.

 * Missing "shell" in the nested call to dpkg-parsechangelog, which
   actually results in SOURCE_DATE_EPOCH being set to midnight of the
   current day, then mangled by the *inverse* of the current timezone
   offset relative to UTC. It's quite a fun chain if you follow it..

A patch for these two issues is attached.

You might also want to fix:

 * Assignment of SOURCE_DATE_EPOCH in debian/rules overrides
   environment, ie. prefer the the set-if-absent operaor.

     - SOURCE_DATE_EPOCH := $(shell [..]
     + SOURCE_DATE_EPOCH ?= $(shell [..]

   .. otherwise, an external value of SOURCE_DATE_EPOCH is not
   honoured.

 * As it happens It's actually not required that you set this line.
   Debian's default toolchain will export it soon anyway, and our
   experimental toolchain does it already.


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby at debian.org / chris-lamb.co.uk
       `-
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: apt-dater.diff.txt
URL: <http://lists.alioth.debian.org/pipermail/reproducible-builds/attachments/20150828/d8189ae7/attachment.txt>