Bug#839977: apache2: please make the build reproducible (timestamps/timezones)

[Daniel Shahaf]

Package: apache2
Version: 2.4.23-5
Severity: wishlist
Tags: patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: timestamps

Dear Maintainer,

Following up on the following change in 2.4.23-5:

  * Tweak creation of .tar.gz embedded in preinst to get reproducible
    build.

The build is not yet reproducible; a further tweak is required:

[[[
diff --git a/debian/rules b/debian/rules
index 5a96c95..800686e 100755
--- a/debian/rules
+++ b/debian/rules
@@ -57,7 +57,7 @@ debian/fixup_conffiles.tgz: \
     debian/config-dir/mods-available/imagemap.load
 	@# mtime/owner/group/mode are for reproducible build
 	tar \
-		--mtime=2000-01-01T00:00 \
+		--mtime=2000-01-01T00:00Z \
 		--owner=root:0 \
 		--group=root:0 \
 		--mode=0644 \
]]]

Without this, the mtime is interpreted in the build environment's
timezone, causing irreproducibility.  (Another form of irreproducibility
in the package is the -fdebug-prefix-map in config.nice, but we'll fix
that globally in the reproducibility infrastructure.)

Thanks for making the package reproducible!

Cheers,

Daniel
('Z' here stands for the 'Zulu' timezone, i.e., UTC+0)