Subject: [bug#28017] [PATCH] Reproducible issue for skalibs

From: "Z. Ren" <[email-masked]>
Date: Tue, 8 Aug 2017 15:33:34 +0800 (GMT+08:00)

Hi!
While conducting a study inspired by the "reproducible builds" practice [1], we have noticed that the package skalibs could not be built reproducibly.

After investigation, we observe that the unreproducibility is caused by "Makefile", in which the order of ALL_SRCS is not sorted. Consequently, the file order of the library files "lib/{libskarnet.so.2.3.10.0, skalibs/libskarnet.a}" may not be deterministic.

The attached patch sorts the ALL_SRCS list, so that the file order in the libraries is deterministic. Once applied, skalibs could be built reproducibly.

 [1]: https://wiki.debian.org/ReproducibleBuilds