From unknown Sat Jun 21 03:16:25 2025 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Mailer: MIME-tools 5.509 (Entity 5.509) Content-Type: text/plain; charset=utf-8 From: bug#57304 <57304@debbugs.gnu.org> To: bug#57304 <57304@debbugs.gnu.org> Subject: Status: Fix mm-common reproduciblility issues Reply-To: bug#57304 <57304@debbugs.gnu.org> Date: Sat, 21 Jun 2025 10:16:25 +0000 retitle 57304 Fix mm-common reproduciblility issues reassign 57304 guix-patches submitter 57304 Vagrant Cascadian severity 57304 normal thanks From debbugs-submit-bounces@debbugs.gnu.org Fri Aug 19 22:51:58 2022 Received: (at submit) by debbugs.gnu.org; 20 Aug 2022 02:51:58 +0000 Received: from localhost ([127.0.0.1]:59439 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1oPEac-0006CF-07 for submit@debbugs.gnu.org; Fri, 19 Aug 2022 22:51:58 -0400 Received: from lists.gnu.org ([209.51.188.17]:52908) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1oPEaX-0006C5-TJ for submit@debbugs.gnu.org; Fri, 19 Aug 2022 22:51:56 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:44482) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oPEaX-0003V1-Ng for guix-patches@gnu.org; Fri, 19 Aug 2022 22:51:53 -0400 Received: from cascadia.aikidev.net ([173.255.214.101]:49778) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oPEaV-0001F1-7M for guix-patches@gnu.org; Fri, 19 Aug 2022 22:51:53 -0400 Received: from localhost (unknown [IPv6:2600:3c01:e000:21:7:77:0:20]) (Authenticated sender: vagrant@aikidev.net) by cascadia.aikidev.net (Postfix) with ESMTPSA id 4DF6C1ABC5 for ; Fri, 19 Aug 2022 19:51:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=reproducible-builds.org; s=1.vagrant; t=1660963902; bh=jIMsGWW6GdO4Oy1tdGoC+vROwZ97kiXdy8Zz/qb+vpQ=; h=From:To:Subject:Date:From; b=hFpHx77e6Swbf5nvkJyov88IC9/SHOF5PTXJEXlDBwdRTXWM1utBD0ODqEGpnd0ya o21yfrHv9v10flrr6pSsaWSKFt+SKUpT2YB9HkLRuV1cUBpFewPM0ZEBwnD9KTQzcn 0UwNTLKbmYb7TlLMlzOC7ppgIMVx4t9fet0RMtYyDn5nvF4y9SNfFVjjkLZQ2kilsw L/EfGBzUc0lO0mpbScge/HHDLa8n09Pd7BOqwfFvnFmfo+gIQ0ekhgY1vYiKl+EZWP pmDWX247qCxi5gis/ZxS4L/H+IHhd9SuUtavJyqAKCVR4eJljKWGUSW4u3UGwQCHAI ZQRVmcYyqcKfQ== From: Vagrant Cascadian To: guix-patches@gnu.org Subject: Fix mm-common reproduciblility issues Date: Fri, 19 Aug 2022 19:51:37 -0700 Message-ID: <874jy7k4p2.fsf@contorta> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="==-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Received-SPF: pass client-ip=173.255.214.101; envelope-from=vagrant@reproducible-builds.org; helo=cascadia.aikidev.net X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) --==-=-= Content-Type: multipart/mixed; boundary="=-=-=" --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable The userid used during the build is embedded in a shipped tarball in the mm-common package. Some abbreviated diffoscope output from guix challenge against builds from ci.guix.gnu.org and bordeax.guix.gnu.org: =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 --- /tmp/guix-directory.rKX8CR/sh= are/doc/mm-common/skeletonmm.tar.xz =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=9C=E2=94=80=E2=94=80 +++ /tmp/guix-dir= ectory.rlW2tI/share/doc/mm-common/skeletonmm.tar.xz =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=9C=E2=94=80=E2=94=80 skeleto= nmm.tar =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=9C=E2=94=80=E2=94= =80 file list =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 @@ -1,36 +1,36 = @@ =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 +-rw-r--r-- 0= nixbld (996) nixbld (30000) 60 2021-05-20 08:57:07.009229 skel= etonmm/.gitignore =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 +-rw-r--r-- 0= nixbld (996) nixbld (30000) 59 2021-05-20 08:57:07.009229 skel= etonmm/AUTHORS =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 +-rw-r--r-- 0= nixbld (996) nixbld (30000) 26527 2021-05-20 08:57:07.009229 skel= etonmm/COPYING ... =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 --rw-r--r-- 0= nixbld (995) nixbld (30000) 60 2021-05-20 08:57:07.009229 skel= etonmm/.gitignore =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 --rw-r--r-- 0= nixbld (995) nixbld (30000) 59 2021-05-20 08:57:07.009229 skel= etonmm/AUTHORS =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 =E2=94=82 --rw-r--r-- 0= nixbld (995) nixbld (30000) 26527 2021-05-20 08:57:07.009229 skel= etonmm/COPYING The attached patch fixes this by setting the user, group, uid and gid consistently. $ guix refresh --list-dependent mm-common Building the following 1138 packages would ensure 2236 dependent packages are rebuilt: ... Looks like it will have to wait for core-updates at least... live well, vagrant --=-=-= Content-Type: text/x-diff Content-Disposition: inline; filename=0001-gnu-mm-common-Build-reproducibly.patch Content-Transfer-Encoding: quoted-printable From=204b359c9bbc918e6dcf1cab1141a9651d6d7bf271 Mon Sep 17 00:00:00 2001 From: Vagrant Cascadian Date: Fri, 19 Aug 2022 19:32:08 -0700 Subject: [PATCH] gnu: mm-common: Build reproducibly. * gnu/packages/patches/mm-common-consistent-user-and-group-in-tarball.patch: New file. * gnu/local.mk (dist_patch_DATA): Add patch. * gnu/packages/gnome.scm (mm-common)[source]: Add patch. =2D-- gnu/local.mk | 1 + gnu/packages/gnome.scm | 5 ++- ...consistent-user-and-group-in-tarball.patch | 40 +++++++++++++++++++ 3 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 gnu/packages/patches/mm-common-consistent-user-and-grou= p-in-tarball.patch diff --git a/gnu/local.mk b/gnu/local.mk index 4e4ad908ce..20d322e27f 100644 =2D-- a/gnu/local.mk +++ b/gnu/local.mk @@ -1516,6 +1516,7 @@ dist_patch_DATA =3D \ %D%/packages/patches/mit-krb5-hurd.patch \ %D%/packages/patches/mixxx-link-qtscriptbytearray-qtscript.patch \ %D%/packages/patches/mixxx-system-googletest-benchmark.patch \ + %D%/packages/patches/mm-common-consistent-user-and-group-in-tarball.patc= h \ %D%/packages/patches/mpc123-initialize-ao.patch \ %D%/packages/patches/mpg321-CVE-2019-14247.patch \ %D%/packages/patches/mpg321-gcc-10.patch \ diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm index ae46e55c51..790881b9d8 100644 =2D-- a/gnu/packages/gnome.scm +++ b/gnu/packages/gnome.scm @@ -1143,7 +1143,10 @@ (define-public mm-common "mm-common-" version ".tar.xz")) (sha256 (base32 =2D "1x8yvjy0yg17qyhmqws8xh2k8dvzrhpwqz7j1cfwzalrb1i9c5g8"))= )) + "1x8yvjy0yg17qyhmqws8xh2k8dvzrhpwqz7j1cfwzalrb1i9c5g8")) + (patches + (search-patches + "mm-common-consistent-user-and-group-in-tarball.patch")))) (build-system meson-build-system) (arguments `(#:phases diff --git a/gnu/packages/patches/mm-common-consistent-user-and-group-in-ta= rball.patch b/gnu/packages/patches/mm-common-consistent-user-and-group-in-t= arball.patch new file mode 100644 index 0000000000..f0890aaf57 =2D-- /dev/null +++ b/gnu/packages/patches/mm-common-consistent-user-and-group-in-tarball.p= atch @@ -0,0 +1,40 @@ +From 024c121c844a4ec920133eb3f7e6b6ee8044c0b6 Mon Sep 17 00:00:00 2001 +From: Vagrant Cascadian +Date: Sat, 12 Dec 2020 04:05:56 +0000 +Original-Patch: https://bugs.debian.org/977177 +Subject: [PATCH] Set uid, username, gid, and group name on files in + generated tarball. + +The user and group may otherwise vary between builds on different systems. + +--- + util/meson_aux/skeletonmm-tarball.py | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/util/meson_aux/skeletonmm-tarball.py b/util/meson_aux/skeleto= nmm-tarball.py +index db9e650..89049b6 100755 +--- a/util/meson_aux/skeletonmm-tarball.py ++++ b/util/meson_aux/skeletonmm-tarball.py +@@ -39,10 +39,18 @@ elif output_file.endswith('.gz'): + else: + mode =3D 'w' +=20 ++def reproducible(tarinfo): ++ # Set consistent user and group on files in the tar archive ++ tarinfo.uid =3D 0 ++ tarinfo.uname =3D 'root' ++ tarinfo.gid =3D 0 ++ tarinfo.gname =3D 'root' ++ return tarinfo ++ + with tarfile.open(output_file, mode=3Dmode) as tar_file: + os.chdir(source_dir) # Input filenames are relative to source_dir. + for file in sys.argv[3:]: +- tar_file.add(file) ++ tar_file.add(file, filter=3Dreproducible) + # Errors raise exceptions. If an exception is raised, Meson+ninja will no= tice + # that the command failed, despite exit(0). + sys.exit(0) +--=20 +2.29.2 + =2D-=20 2.35.1 --=-=-=-- --==-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iHQEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCYwBMOgAKCRDcUY/If5cW qj+SAP9EL+FWqTYx+VH5wPj6XJLXeTGbfqU0is59CvDhnrEvHwD2P+oD/A4zPKW4 nFQLtY5HXmgtsOtGnjehjVmxvqwVCQ== =kiIJ -----END PGP SIGNATURE----- --==-=-=-- From debbugs-submit-bounces@debbugs.gnu.org Tue Aug 30 16:34:44 2022 Received: (at 57304) by debbugs.gnu.org; 30 Aug 2022 20:34:45 +0000 Received: from localhost ([127.0.0.1]:37626 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1oT7wa-0007i9-Le for submit@debbugs.gnu.org; Tue, 30 Aug 2022 16:34:44 -0400 Received: from eggs.gnu.org ([209.51.188.92]:34784) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1oT7wX-0007hu-49 for 57304@debbugs.gnu.org; Tue, 30 Aug 2022 16:34:43 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:55424) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oT7wR-0006pC-Kx; Tue, 30 Aug 2022 16:34:35 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:In-Reply-To:Date:References:Subject:To: From; bh=fJmNBJvyBWz7RnxApo4d/E+jdXEcpM2CNVSXxJWtofM=; b=K/AWigu2JXrFtAy6vsQA 9q5eQwycJPAcfjqoJa22rhcxhreRW2vglhLe7v6rEE7LXMMNNEXz0emsK9C3cQ0lLMcpzq9HNF1C1 SWT9OzgXC3I9yWbUsCWFfiNXZVfTlfpVpVAi7TOXqTg/fcu9zt7HHnwZpNQbwiA+FZadXFzobY5Uj r22hyDlutAv46/j1oNfT/dSzf39bHgeM8d6rrqu76bsMZxJ+PctE/u617QA/T2yddVaeG1if/8dA2 e2SgnMceg6TRiilIAim/9uYNtfqae1zUvSHD04fVywsPOLKLiiPETd5BruNX4eSxuImbSq8D8fs2V j4b63RwVW1o8ng==; Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=44228 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oT7wR-0005RL-2Y; Tue, 30 Aug 2022 16:34:35 -0400 From: =?utf-8?Q?Ludovic_Court=C3=A8s?= To: Vagrant Cascadian Subject: Re: bug#57304: Fix mm-common reproduciblility issues References: <874jy7k4p2.fsf@contorta> Date: Tue, 30 Aug 2022 22:34:33 +0200 In-Reply-To: <874jy7k4p2.fsf@contorta> (Vagrant Cascadian's message of "Fri, 19 Aug 2022 19:51:37 -0700") Message-ID: <87czcheahy.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 57304 Cc: 57304@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Hi, Vagrant Cascadian skribis: > The userid used during the build is embedded in a shipped tarball in the > mm-common package. Some abbreviated diffoscope output from guix > challenge against builds from ci.guix.gnu.org and bordeax.guix.gnu.org: Good catch. > The attached patch fixes this by setting the user, group, uid and gid > consistently. > > $ guix refresh --list-dependent mm-common > Building the following 1138 packages would ensure 2236 dependent > packages are rebuilt: ... > > Looks like it will have to wait for core-updates at least... Yeah, let=E2=80=99s apply it on =E2=80=98core-updates=E2=80=99. > From 4b359c9bbc918e6dcf1cab1141a9651d6d7bf271 Mon Sep 17 00:00:00 2001 > From: Vagrant Cascadian > Date: Fri, 19 Aug 2022 19:32:08 -0700 > Subject: [PATCH] gnu: mm-common: Build reproducibly. > > * gnu/packages/patches/mm-common-consistent-user-and-group-in-tarball.pat= ch: > New file. > * gnu/local.mk (dist_patch_DATA): Add patch. > * gnu/packages/gnome.scm (mm-common)[source]: Add patch. [...] > + %D%/packages/patches/mm-common-consistent-user-and-group-in-tarball.pa= tch \ I=E2=80=99d suggest a shorter name to appease =E2=80=98tar=E2=80=99, say =E2=80=98mm-common-reproducible-tarball.patch=E2=80=99. Otherwise LGTM, thanks! Ludo=E2=80=99. From debbugs-submit-bounces@debbugs.gnu.org Tue Aug 30 20:46:21 2022 Received: (at 57304-done) by debbugs.gnu.org; 31 Aug 2022 00:46:21 +0000 Received: from localhost ([127.0.0.1]:37729 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1oTBs3-0005WL-91 for submit@debbugs.gnu.org; Tue, 30 Aug 2022 20:46:21 -0400 Received: from cascadia.aikidev.net ([173.255.214.101]:56392) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1oTBry-0005W5-76 for 57304-done@debbugs.gnu.org; Tue, 30 Aug 2022 20:46:17 -0400 Received: from localhost (unknown [IPv6:2600:3c01:e000:21:7:77:0:20]) (Authenticated sender: vagrant@aikidev.net) by cascadia.aikidev.net (Postfix) with ESMTPSA id BBBD51AD16; Tue, 30 Aug 2022 17:46:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=reproducible-builds.org; s=1.vagrant; t=1661906766; bh=zPl/XK7BEQMV8YXmHS/2eGaXu8IMzeput3LVA2u5xXA=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=j3Fe7YVHHZBT2OkToTdz831eOz+XQMgaW0AbGzTIfc5ToA/c3/w0XGyYgW8DvoqHv 4vmcggtFVSo3fzX6qPHT8mbVYh5DBjclBtbgu5VWJrO4zW+zWhatBiy0UhPKoyNjL0 rzESXMzMmAQgwaoQhbPP0vQvwzG/dHdANG8VSZ34QfHsg4qKsSAuoToPzy5Or47Z4k Xuacf54GBCgkHped33S7/1xXr0eWj86IYb/bleizd4Tcz7I+zcCaSaARLp/DEzGH1C jB1BOdc7YyfpGogzCSQ4aN6srhNCG+a0oAjkbc/0KD5nMyB+AG5qQ+IchsCfad7C2V PmO5B3BmMD6Eg== From: Vagrant Cascadian To: Ludovic =?utf-8?Q?Court=C3=A8s?= Subject: Re: bug#57304: Fix mm-common reproduciblility issues In-Reply-To: <87czcheahy.fsf@gnu.org> References: <874jy7k4p2.fsf@contorta> <87czcheahy.fsf@gnu.org> Date: Tue, 30 Aug 2022 17:46:01 -0700 Message-ID: <87h71tfdfa.fsf@contorta> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 57304-done Cc: 57304-done@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 2022-08-30, Ludovic Court=C3=A8s wrote: > Vagrant Cascadian skribis: >> The userid used during the build is embedded in a shipped tarball in the >> mm-common package. Some abbreviated diffoscope output from guix >> challenge against builds from ci.guix.gnu.org and bordeax.guix.gnu.org: > > Good catch. > >> The attached patch fixes this by setting the user, group, uid and gid >> consistently. >> >> $ guix refresh --list-dependent mm-common >> Building the following 1138 packages would ensure 2236 dependent >> packages are rebuilt: ... >> >> Looks like it will have to wait for core-updates at least... > > Yeah, let=E2=80=99s apply it on =E2=80=98core-updates=E2=80=99. > >> From 4b359c9bbc918e6dcf1cab1141a9651d6d7bf271 Mon Sep 17 00:00:00 2001 >> From: Vagrant Cascadian >> Date: Fri, 19 Aug 2022 19:32:08 -0700 >> Subject: [PATCH] gnu: mm-common: Build reproducibly. >> >> * gnu/packages/patches/mm-common-consistent-user-and-group-in-tarball.pa= tch: >> New file. >> * gnu/local.mk (dist_patch_DATA): Add patch. >> * gnu/packages/gnome.scm (mm-common)[source]: Add patch. > > [...] > >> + %D%/packages/patches/mm-common-consistent-user-and-group-in-tarball.p= atch \ > > I=E2=80=99d suggest a shorter name to appease =E2=80=98tar=E2=80=99, say > =E2=80=98mm-common-reproducible-tarball.patch=E2=80=99. I do not think tar is too worried about that anymore since the updated tar format, but it is easier on human eyes, so I'll go along with it. :) Pushed 5ce7178eb8375716625de14f59e227fdd9b8d9f0 to core-updates! live well, vagrant --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCYw6vSgAKCRDcUY/If5cW qolJAQC/ZkONpQIVrQcmd26nkbkfiOGTJhFGPr367oXPugQ3IAEAzyMeqcBVVGv/ xu4v164mR3ImjqBK2WgCpx40iAyirQM= =qk/E -----END PGP SIGNATURE----- --=-=-=-- From unknown Sat Jun 21 03:16:25 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Wed, 28 Sep 2022 11:24:04 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator