[Reproducible-builds] Bug#802005: debhelper: sort file lists passed to 'cp --parents -p' for reproducibility

[Niko Tyni]

Package: debhelper
Version: 9.20151005
Severity: wishlist
Tags: patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: toolchain timestamps
X-Debbugs-Cc: reproducible-builds at lists.alioth.debian.org

As noticed by Santiago Vila [1], timestamps of directories created by
dh_installchangelogs (and probably dh_install and dh_installdocs) can
vary depending on the filesystem readdir() order.

This is because the 'cp --parents -p' calls create subdirectories with
different timestamps depending on the order of files processed. If the
directory gets created as a parent of an installed file, its timestamp
is first preserved, but if other files are later copied under it, the
stamp gets updated. There's a recipe that shows this happening in [2].

The simplest fix I can come up with is to add a 'sort -z' in the find +
xargs pipeline.  See the attached proposed patches.

Please note that I've done only light testing of the patches, so review
would be very welcome. The line wrapping changings are because t/size
enforces a maximum of 160 characters per line.

FWIW, it seems to me that using 'cpio -pdm' instead of 'cp --parents -p'
would be cleaner and more efficient, but that's a more intrusive change
with more risk for breakage. And perhaps there's a reason for using 'cp'
that I'm missing?

[1] thread at
 http://lists.alioth.debian.org/pipermail/reproducible-builds/Week-of-Mon-20151005/003556.html
 http://lists.alioth.debian.org/pipermail/reproducible-builds/Week-of-Mon-20151012/003574.html

[2]
 http://lists.alioth.debian.org/pipermail/reproducible-builds/Week-of-Mon-20151005/003567.html

-- 
Niko Tyni   ntyni at debian.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-dh_installexamples-use-find-xargs-instead-of-find-ex.patch
Type: text/x-diff
Size: 1211 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/reproducible-builds/attachments/20151016/9166611b/attachment.patch>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-dh_install-sort-file-lists-passed-to-cp-parents-p-fo.patch
Type: text/x-diff
Size: 2957 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/reproducible-builds/attachments/20151016/9166611b/attachment-0001.patch>