[bug#32410] [PATCH] libgcrypt: Make it reproducible

[bug#32410] [PATCH] libgcrypt: Make it reproducible

[Björn Höfling]

[-- Attachment #1.1: Type: text/plain, Size: 357 bytes --]

This is a fix for core-updates.

The libgcrypt package contains a yat2m command that adds a timestamp
into the generated man-page. The (more or less) same C-file exits
also in the packages gnupg and libgpg-error. There it already considers
SOURCE_DATE_EPOCH. I diffed from gnupg and removed unrelated things.

I will also report upstream.

Björn

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1.2: 0001-gnu-libgcrypt-Make-build-reproducible.patch --]
[-- Type: text/x-patch, Size: 3319 bytes --]

From 908c760f89ae5b47edbb0124339eab5801196f62 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20H=C3=B6fling?=
 <bjoern.hoefling@bjoernhoefling.de>
Date: Thu, 9 Aug 2018 16:45:45 +0200
Subject: [PATCH] gnu: libgcrypt: Make build reproducible.

* gnu/packages/patches/libgcrypt-make-yat2m-reproducible.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/gnupg.scm (libgcrypt)[source]: Use it.
---
 gnu/local.mk                                  |  1 +
 gnu/packages/gnupg.scm                        |  4 ++-
 .../libgcrypt-make-yat2m-reproducible.patch   | 32 +++++++++++++++++++
 3 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 gnu/packages/patches/libgcrypt-make-yat2m-reproducible.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 9eb636037..d242f355b 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -858,6 +858,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/libevent-2.1-skip-failing-test.patch	\
   %D%/packages/patches/libexif-CVE-2016-6328.patch		\
   %D%/packages/patches/libexif-CVE-2017-7544.patch		\
+  %D%/packages/patches/libgcrypt-make-yat2m-reproducible.patch	\
   %D%/packages/patches/libgit2-mtime-0.patch			\
   %D%/packages/patches/libgdata-fix-tests.patch			\
   %D%/packages/patches/libgdata-glib-duplicate-tests.patch	\
diff --git a/gnu/packages/gnupg.scm b/gnu/packages/gnupg.scm
index 54b44996e..942f975e5 100644
--- a/gnu/packages/gnupg.scm
+++ b/gnu/packages/gnupg.scm
@@ -101,7 +101,9 @@ Daemon and possibly more in the future.")
                                  version ".tar.bz2"))
              (sha256
               (base32
-               "0z5gs1khzyknyfjr19k8gk4q148s6q987ya85cpn0iv70fz91v36"))))
+               "0z5gs1khzyknyfjr19k8gk4q148s6q987ya85cpn0iv70fz91v36"))
+             (patches
+              (search-patches "libgcrypt-make-yat2m-reproducible.patch"))))
     (build-system gnu-build-system)
     (propagated-inputs
      `(("libgpg-error-host" ,libgpg-error)))
diff --git a/gnu/packages/patches/libgcrypt-make-yat2m-reproducible.patch b/gnu/packages/patches/libgcrypt-make-yat2m-reproducible.patch
new file mode 100644
index 000000000..3056f0baa
--- /dev/null
+++ b/gnu/packages/patches/libgcrypt-make-yat2m-reproducible.patch
@@ -0,0 +1,32 @@
+Make yat2m in libgcrypt respect SOURCE_DATE_EPOCH, making
+the build reproducible.
+
+This was already fixed upstream in GnuPG:
+https://dev.gnupg.org/rG139de02b93773615bdd95e04a7f0c1ad73b4f6fb
+
+and in libgpg-error:
+https://dev.gnupg.org/rE5494a5728418938d2e42158bb646b07124184e64
+
+
+--- a/doc/yat2m.c 2017-11-23 19:16:58.000000000 +0100
++++ b/doc/yat2m.c 2017-08-28 12:22:54.000000000 +0200
+@@ -1475,6 +1484,7 @@
+ main (int argc, char **argv)
+ {
+   int last_argc = -1;
++  const char *s;
+ 
+   opt_source = "GNU";
+   opt_release = "";
+@@ -1608,6 +1618,11 @@
+   if (argc > 1)
+     die ("usage: " PGM " [OPTION] [FILE] (try --help for more information)\n");
+ 
++  /* Take care of supplied timestamp for reproducible builds.  See
++   * https://reproducible-builds.org/specs/source-date-epoch/  */
++  if (!opt_date && (s = getenv ("SOURCE_DATE_EPOCH")) && *s)
++    opt_date = s;
++
+   /* Start processing. */
+   if (argc && strcmp (*argv, "-"))
+     {
-- 
2.18.0


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

[bug#32410] [PATCH] libgcrypt: Make it reproducible

[Björn Höfling]

[-- Attachment #1: Type: text/plain, Size: 725 bytes --]

On Thu, 9 Aug 2018 17:04:29 +0200
Björn Höfling <bjoern.hoefling@bjoernhoefling.de> wrote:

> This is a fix for core-updates.
> 
> The libgcrypt package contains a yat2m command that adds a timestamp
> into the generated man-page. The (more or less) same C-file exits
> also in the packages gnupg and libgpg-error. There it already
> considers SOURCE_DATE_EPOCH. I diffed from gnupg and removed
> unrelated things.

Concerning tests:

1. It compiles.
2. New manpage does contain an EPOCH timestamp.
3. gpg -c still works (And strace says it's loading the new libgcrypt).
4. diffoscope of old and new store entry only shows the manpage change
and of cause reference updates into new store entry.

Björn

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

bug#32410: [PATCH] libgcrypt: Make it reproducible

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 992 bytes --]

On Thu, Aug 09, 2018 at 05:04:29PM +0200, Björn Höfling wrote:
> This is a fix for core-updates.
> 
> The libgcrypt package contains a yat2m command that adds a timestamp
> into the generated man-page. The (more or less) same C-file exits
> also in the packages gnupg and libgpg-error. There it already considers
> SOURCE_DATE_EPOCH. I diffed from gnupg and removed unrelated things.
> 
> I will also report upstream.

Thanks, please reply with a link to the upstream discussion.

> From 908c760f89ae5b47edbb0124339eab5801196f62 Mon Sep 17 00:00:00 2001
> From: =?UTF-8?q?Bj=C3=B6rn=20H=C3=B6fling?=
>  <bjoern.hoefling@bjoernhoefling.de>
> Date: Thu, 9 Aug 2018 16:45:45 +0200
> Subject: [PATCH] gnu: libgcrypt: Make build reproducible.
> 
> * gnu/packages/patches/libgcrypt-make-yat2m-reproducible.patch: New file.
> * gnu/local.mk (dist_patch_DATA): Add it.
> * gnu/packages/gnupg.scm (libgcrypt)[source]: Use it.

Pushed as 4866cba66ae40d722bb6c50b7dca27725ffa4532

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[bug#32410] [PATCH] libgcrypt: Make it reproducible

[Björn Höfling]

[-- Attachment #1: Type: text/plain, Size: 1246 bytes --]

On Thu, 16 Aug 2018 17:11:06 -0400
Leo Famulari <leo@famulari.name> wrote:

> On Thu, Aug 09, 2018 at 05:04:29PM +0200, Björn Höfling wrote:
> > This is a fix for core-updates.
> > 
> > The libgcrypt package contains a yat2m command that adds a timestamp
> > into the generated man-page. The (more or less) same C-file exits
> > also in the packages gnupg and libgpg-error. There it already
> > considers SOURCE_DATE_EPOCH. I diffed from gnupg and removed
> > unrelated things.
> > 
> > I will also report upstream.  
> 
> Thanks, please reply with a link to the upstream discussion.

It's not (yet) a discussion :-) The task is tracked here:

https://dev.gnupg.org/T4102


> > From 908c760f89ae5b47edbb0124339eab5801196f62 Mon Sep 17 00:00:00
> > 2001 From: =?UTF-8?q?Bj=C3=B6rn=20H=C3=B6fling?=
> >  <bjoern.hoefling@bjoernhoefling.de>
> > Date: Thu, 9 Aug 2018 16:45:45 +0200
> > Subject: [PATCH] gnu: libgcrypt: Make build reproducible.
> > 
> > * gnu/packages/patches/libgcrypt-make-yat2m-reproducible.patch: New
> > file.
> > * gnu/local.mk (dist_patch_DATA): Add it.
> > * gnu/packages/gnupg.scm (libgcrypt)[source]: Use it.  
> 
> Pushed as 4866cba66ae40d722bb6c50b7dca27725ffa4532

Thanks.

Björn

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]