[Reproducible-builds] reproducible build examples

[Christian T. Steigies]

Hi,
On Fri, Mar 11, 2016 at 02:59:08PM +0100, J?r?my Bobbio wrote:
> Hi!
> 
> Christian T. Steigies:
> > I am trying to make my packages reproducible, I am trying this since last
> > debconf (but only from time to time). The examples seem to have changed
> > after debconf, but some things are more clear to me now (ie that I can not
> > use a date string).
> 
> Glad to read that! Please use the public
> <reproducible-builds at lists.alioth.debian.org> mailing list next times:
> others might be more responsive than me. :)

Ok, Cc'ed on this message.
 
> > However, I have problems with the examples:
> > 
> > https://wiki.debian.org/ReproducibleBuilds/TimestampsProposal#Examples
> > 
> > They do not seem to work for me out of the box (maybe you can provide links
> > to real examples, you are publishing progress reports, shouldn't they make
> > nice examplees?).
> 
> Indeed. That's why there's ???proposed patches??? section with links to bug
> reports in almost each report.

I have seen one which simply removed the timestamp from the executable. I do
not consider that as a solution, it is just a quick and dirty workaround.
 
> > Actually, for the python and C example I think it can not
> > work at all, please prove me wrong. To me it seems that the python, perl and
> > C examples are reading SOURCE_DATE_EPOCH from the environment during
> > runtime, not during buildtime. If this variable is not defined, the current
> > time is used, which is not what I would expect if I understand this
> > correctly. Shouldn't the SOURCE_DATE_EPOCH be defined during the build and
> > this (static) value be used in the binary?
> 
> The examples are designed for code or documentation generators, not for
> integration in code that is shipped in the end. I'm not sure how we can
> make that clearer.

I don't know how big of a problem this is, if it is worth the effort. But I
think more documentation, more examples are always good. It took me a while
to figure this out, only to realize that also the documentation is affected,
in two different places.

The webpage was not very helpful at the beginning:
https://tests.reproducible-builds.org/rb-pkg/unstable/amd64/gle-graphics.html
 
The start page mentions problems which (I though) I had fixed long ago.
The diffoscope page (not there anymore due to FTBFS?) showed the actual
problems. It would have been nice, however, if it would have said in big
letters, that latex can not build reproducible PDFs since a timestamp is
embedded. So in my last try, I use faketime to generate the documentation,
which seems to work on my system, but generates an FTBFS on the jenkins
servers. I think it is this bug (also affects one of the buildds):

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=778462

Now I m stuck, can I not use faketime to build PDFs? How should I build PDFs
then? Or is this a bug in the testing servers and I have to wait until they
are fixed (also the hurd-i386 buildd)?

I wonder if I can test reproducibility without a full upload, only to
realize there is another timestamp hidden somewhere.

thanks,
Christian