[Reproducible-builds] Bug#803482: ncurses: please make the build reproducible, take two

[Sven Joachim]

On 2015-10-30 14:32 +0100, Esa Peuha wrote:

> While ncurses 6.0+20151017-1 fixed the earlier reproducibility bug
> #801864, it also introduced a reproducibility regression; now all the
> lib*_g.a files in the lib*-dbg packages are affected by the umask,
> uid/gid and build time of the build environment. The reason for this
> regression is upstream patch 20151010, specifically the update of
> CF_AR_FLAGS in aclocal.m4 (which is propagated to configure) that
> causes the static libraries to be generated with "ar -curvU".

The NEWS entry for the patch in question mentions a reason:

,----
| 	+ add workaround for breakage of POSIX makefiles by recent binutils
| 	  change.
`----

This seems to refer to make's implicit rule for archive members[1]:

,----
| If a target or prerequisite contains parentheses, it shall be treated as
| a member of an archive library. For the lib( member .o) expression lib
| refers to the name of the archive library and member .o to the member
| name. The application shall ensure that the member is an object file
| with the .o suffix. The modification time of the expression is the
| modification time for the member as kept in the archive library; see ar.
`----

> I don't
> really know where this should be fixed (patching aclocal.m4 doesn't
> seem right since it's a generated file) so I can't suggest a patch.

Certainly aclocal.m4 is _not_ a generated file in ncurses, but given the
above I'd be reluctant to revert the upstream change.  Possible
solutions are to run dh_strip_nondeterminism on the -dbg packages, or to
just remove the static debug libraries (I don't think they actually
work anyway, see #556378 for reasons).

Cheers,
       Sven


1. http://pubs.opengroup.org/onlinepubs/009695399/utilities/make.html