Reproducible build of xapian-bindings for python - patch included

Danny Milosavljevic <[email protected]> Mon, 26 Nov 2018 12:36:32 +0100

Newsgroups	gmane.comp.search.xapian.devel
Message-ID	<[email protected]>

Hi,

we're trying to make all builds reproducible, aiming to provide a verifiable path from source code to binary.

In the course of that we found that the output produced by the python xapian-bindings is not reproducible.

The reason is that in python3/Makefile.am there's a "cp" statement without "-p" - which means it will not preserve timestamps but rather generate a new timestamp every time - making every build output different.

(We do have a general snippet to reset timestamps, but it comes too late - by that time, the pyc file already contains the ever-changing source timestamp and thus is also ever-changing)

So we patch xapian-bindings to include the "-p" option on our side.

Would you be willing to apply the patch below?

--- xapian-bindings-1.4.9/python/Makefile.am.orig	2018-11-26 12:31:21.484852123 +0100
+++ xapian-bindings-1.4.9/python/Makefile.am	2018-11-26 12:31:46.252580636 +0100
@@ -73,7 +73,7 @@ _xapian_la_LIBADD = $(XAPIAN_LIBS) $(PYT
 # as a package.
 xapian/__init__.py: xapian.py
 	$(MKDIR_P) xapian
-	cp `test -f xapian.py || echo '$(srcdir)/'`xapian.py xapian/__init__.py
+	cp -p `test -f xapian.py || echo '$(srcdir)/'`xapian.py xapian/__init__.py
 
 # We "import _xapian" first so that if we fail to import the glue library
 # we don't generate a broken .pyc or .pyo, and we do it with the current
--- xapian-bindings-1.4.9/python3/Makefile.am.orig	2018-11-26 12:31:26.068801861 +0100
+++ xapian-bindings-1.4.9/python3/Makefile.am	2018-11-26 12:31:39.416655546 +0100
@@ -72,7 +72,7 @@ _xapian_la_LIBADD = $(XAPIAN_LIBS) $(PYT
 # as a package.
 xapian/__init__.py: xapian.py
 	$(MKDIR_P) xapian
-	cp `test -f xapian.py || echo '$(srcdir)/'`xapian.py xapian/__init__.py
+	cp -p `test -f xapian.py || echo '$(srcdir)/'`xapian.py xapian/__init__.py
 
 # We "import _xapian" first so that if we fail to import the glue library
 # we don't generate a broken .pyc or .pyo, and we do it with the current

signature.asc (application/pgp-signature, 488 B)