[bug #57218] Reproducible builds support is broken and embeds timezone

[Eli Schwartz]

URL:
  <https://savannah.gnu.org/bugs/?57218>

                 Summary: Reproducible builds support is broken and embeds
timezone
                 Project: GNU troff
            Submitted by: eschwartz
            Submitted on: Wed 13 Nov 2019 05:58:06 AM UTC
                Category: Core
                Severity: 3 - Normal
              Item Group: None
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None

    _______________________________________________________

Details:

Reproducible builds support was initially implemented via
https://git.savannah.gnu.org/cgit/groff.git/commit/?id=e4290210f2c1db5292d97678197a986d6822d044

See discussion here:
https://lists.gnu.org/archive/html/groff/2014-08/msg00112.html
https://lists.gnu.org/archive/html/groff/2015-11/msg00013.html

However, the implementation falls short of true reproducibility. I've been
attempting to reproduce Arch Linux's "man-db" package, and discovered that
/usr/share/doc/man-db/man-db-manual.ps is not reproducible, with this
differing content:

│ ├── usr/share/doc/man-db/man-db-manual.ps
│ │ @@ -1,10 +1,10 @@
│ │  %!PS-Adobe-3.0
│ │  %%Creator: groff version 1.22.4
│ │ -%%CreationDate: Wed Oct 23 21:52:35 2019
│ │ +%%CreationDate: Wed Oct 23 15:52:35 2019
│ │  %%DocumentNeededResources: font Times-Bold
│ │  %%+ font Times-Italic
│ │  %%+ font Times-Roman
│ │  %%+ font Symbol
│ │  %%DocumentSuppliedResources: procset grops 1.22 4
│ │  %%Pages: 26
│ │  %%PageOrder: Ascend

Note the CreationDate. I'm building the software using an exported
SOURCE_DATE_EPOCH=1571860355

It is successfully built in the past, but on the other hand, it does not
include a timezone, it is not in UTC time, and my timezone, -0500, is being
embedded here:

$ date -R -d @1571860355 
Wed, 23 Oct 2019 15:52:35 -0400

What I'd expect to see embedded:

$ TZ=UTC date -R -d @1571860355
Wed, 23 Oct 2019 19:52:35 +0000

And the person who built the initial upload of the software:

$ TZ=CET date -R -d @1571860355
Wed, 23 Oct 2019 21:52:35 +0200

In order to properly support reproducible builds, I believe the localtime
should not be used, and times must be converted to UTC time.




    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?57218>

_______________________________________________
  Message sent via Savannah
  https://savannah.gnu.org/