Bug#1140613: dpkg-genbuildinfo: record dpkg-deb compressor env vars in .buildinfo for reproducible rebuilds

--000000000000f50c100654ec56ff
Content-Type: multipart/alternative; boundary="000000000000f50c0d0654ec56fb"

--000000000000f50c0d0654ec56fb
Content-Type: text/plain; charset="UTF-8"

Package: dpkg-dev
Version: 1.23.7
Severity: wishlist
Tags: patch

Dear Maintainer,

If the build environments have different DPKG_DEB_COMPRESSOR_{TYPE,LEVEL}
environment variables, debrebuild fails with a checksum mismatch.

debrebuild sets the environment variables from the buildinfo file
Environment block and since these variables affect reproducibility of
the package, it would make sense to include them.

I've attached a patch that adds these variables to the allow list and
makes debrebuild 'just work' in this case.
It shouldn't affect the official buildinfo files or the resulting builds.

If this approach is not suitable for any reason, let me know and I'm happy
to rework it.

Many thanks,

Serge


-- System Information:
Debian Release: forky/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 6.12.90+deb13.1-amd64 (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8),
LANGUAGE=en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages dpkg-dev depends on:
ii  binutils      2.46.50.20260617-1
ii  bzip2         1.0.8-6+b2
ii  libdpkg-perl  1.23.7
ii  make          4.4.1-3
ii  patch         2.8-2
ii  perl          5.40.1-8
ii  tar           1.35+dfsg-4
ii  xz-utils      5.8.3-1

Versions of packages dpkg-dev recommends:
ii  build-essential          12.12
ii  fakeroot                 1.38.1-1
ii  gcc [c-compiler]         4:15.2.0-5+b1
ii  gcc-14 [c-compiler]      14.3.0-16
ii  gcc-15 [c-compiler]      15.3.0-1
ii  gnupg                    2.4.9-4
ii  gpgv                     2.4.9-4
ii  libalgorithm-merge-perl  0.08-5
ii  sq                       1.3.1-10
ii  sqv                      1.3.0-5+b2

Versions of packages dpkg-dev suggests:
ii  debian-keyring             2026.05.24
ii  debian-tag2upload-keyring  1.2

-- no debconf information

--000000000000f50c0d0654ec56fb
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Package: dpkg-dev<br>Version: 1.23.7<br>Severity: wishlist=
<br>Tags: patch<br><br>Dear Maintainer,<br><br>If the build environments ha=
ve different DPKG_DEB_COMPRESSOR_{TYPE,LEVEL}<br>environment variables, deb=
rebuild fails with a checksum mismatch.<br><br>debrebuild sets the environm=
ent variables from the buildinfo file<br>Environment block and since these =
variables affect reproducibility of<br>the package, it would make sense to =
include them.<br><br>I&#39;ve attached a patch that adds these variables to=
 the allow list and<br>makes debrebuild &#39;just work&#39; in this case.<b=
r>It shouldn&#39;t affect the official buildinfo files or the resulting bui=
lds.<br><br>If this approach is not suitable for any reason, let me know an=
d I&#39;m happy<br>to rework it.<br><br>Many thanks,<br><br>Serge<br><br><b=
r>-- System Information:<br>Debian Release: forky/sid<br>=C2=A0 APT prefers=
 unstable<br>=C2=A0 APT policy: (500, &#39;unstable&#39;), (500, &#39;testi=
ng&#39;)<br>Architecture: amd64 (x86_64)<br><br>Kernel: Linux 6.12.90+deb13=
.1-amd64 (SMP w/4 CPU threads; PREEMPT)<br>Locale: LANG=3Den_GB.UTF-8, LC_C=
TYPE=3Den_GB.UTF-8 (charmap=3DUTF-8), LANGUAGE=3Den_GB:en<br>Shell: /bin/sh=
 linked to /usr/bin/dash<br>Init: systemd (via /run/systemd/system)<br>LSM:=
 AppArmor: enabled<br><br>Versions of packages dpkg-dev depends on:<br>ii =
=C2=A0binutils =C2=A0 =C2=A0 =C2=A02.46.50.20260617-1<br>ii =C2=A0bzip2 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 1.0.8-6+b2<br>ii =C2=A0libdpkg-perl =C2=A01.23.7<b=
r>ii =C2=A0make =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A04.4.1-3<br>ii =C2=A0patch=
 =C2=A0 =C2=A0 =C2=A0 =C2=A0 2.8-2<br>ii =C2=A0perl =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A05.40.1-8<br>ii =C2=A0tar =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 1.=
35+dfsg-4<br>ii =C2=A0xz-utils =C2=A0 =C2=A0 =C2=A05.8.3-1<br><br>Versions =
of packages dpkg-dev recommends:<br>ii =C2=A0build-essential =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A012.12<br>ii =C2=A0fakeroot =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 1.38.1-1<br>ii =C2=A0gcc [c-compiler] =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 4:15.2.0-5+b1<br>ii =C2=A0gcc-14 [c-compiler] =C2=A0 =
=C2=A0 =C2=A014.3.0-16<br>ii =C2=A0gcc-15 [c-compiler] =C2=A0 =C2=A0 =C2=A0=
15.3.0-1<br>ii =C2=A0gnupg =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
 =C2=A0 =C2=A0 =C2=A02.4.9-4<br>ii =C2=A0gpgv =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 2.4.9-4<br>ii =C2=A0libalgorithm-=
merge-perl =C2=A00.08-5<br>ii =C2=A0sq =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 1.3.1-10<br>ii =C2=A0sqv =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A01.3.0-=
5+b2<br><br>Versions of packages dpkg-dev suggests:<br>ii =C2=A0debian-keyr=
ing =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 2026.05.24<br>ii =C2=A0debian=
-tag2upload-keyring =C2=A01.2<br><br>-- no debconf information</div>

--000000000000f50c0d0654ec56fb--
--000000000000f50c100654ec56ff
Content-Type: text/x-patch; charset="US-ASCII"; 
	name="0001-Dpkg-BuildInfo-Add-dpkg-deb-compressor-variables-to-.patch"
Content-Disposition: attachment; 
	filename="0001-Dpkg-BuildInfo-Add-dpkg-deb-compressor-variables-to-.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mqqq1dio0>
X-Attachment-Id: f_mqqq1dio0

RnJvbSA2MTNhYzE0NzIwYzVlY2Y2OWQxMDI1MTFhNGFkOWZhZjJkYzhjODQzIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBTZXJnZSBTY2huZWlkZXIgPHNlcmdlQHJhc3BiZXJyeXBpLmNv
bT4KRGF0ZTogVHVlLCAyMyBKdW4gMjAyNiAxNDowMDo0MSArMDEwMApTdWJqZWN0OiBbUEFUQ0hd
IERwa2c6OkJ1aWxkSW5mbzogQWRkIGRwa2ctZGViIGNvbXByZXNzb3IgdmFyaWFibGVzIHRvIHRo
ZSBlbnYKIGFsbG93bGlzdAoKUmVjb3JkIERQS0dfREVCX0NPTVBSRVNTT1JfVFlQRSBhbmQgRFBL
R19ERUJfQ09NUFJFU1NPUl9MRVZFTCBpbiB0aGUKLmJ1aWxkaW5mbyBFbnZpcm9ubWVudCBmaWVs
ZCwgc28gYSByZWJ1aWxkIHJlcHJvZHVjZXMgdGhlIGJpbmFyeSBwYWNrYWdlCmNvbXByZXNzaW9u
LiBkZWJyZWJ1aWxkIGFscmVhZHkgcmUtZXhwb3J0cyB0aGUgRW52aXJvbm1lbnQgZmllbGQuCi0t
LQogc2NyaXB0cy9EcGtnL0J1aWxkSW5mby5wbSAgfCA3ICsrKysrKysKIHNjcmlwdHMvdC9EcGtn
X0J1aWxkSW5mby50IHwgMiArLQogMiBmaWxlcyBjaGFuZ2VkLCA4IGluc2VydGlvbnMoKyksIDEg
ZGVsZXRpb24oLSkKCmRpZmYgLS1naXQgYS9zY3JpcHRzL0Rwa2cvQnVpbGRJbmZvLnBtIGIvc2Ny
aXB0cy9EcGtnL0J1aWxkSW5mby5wbQppbmRleCA1YWM4OTgzNWUuLjdmMzAyMmYxOCAxMDA2NDQK
LS0tIGEvc2NyaXB0cy9EcGtnL0J1aWxkSW5mby5wbQorKysgYi9zY3JpcHRzL0Rwa2cvQnVpbGRJ
bmZvLnBtCkBAIC0xNjcsNiArMTY3LDEzIEBAIG15IEBlbnZfYWxsb3dlZCA9ICgKICAgICAgICAg
RFBLR19ST09UCiAgICAgICAgIERQS0dfQURNSU5ESVIKICAgICApLAorICAgICMgU2VlIGRwa2ct
ZGViKDEpLiBUaGVzZSBhZmZlY3QgdGhlIGNvbXByZXNzaW9uIG9mIHRoZSBwcm9kdWNlZCBiaW5h
cnkKKyAgICAjIHBhY2thZ2VzLCBhbmQgdGh1cyB0aGUgcmVzdWx0aW5nIGJ5dGVzLCBzbyB0aGV5
IGFyZSBuZWVkZWQgdG8gcmVwcm9kdWNlCisgICAgIyBieXRlLWlkZW50aWNhbCAuZGViIGZpbGVz
LgorICAgIHF3KAorICAgICAgICBEUEtHX0RFQl9DT01QUkVTU09SX1RZUEUKKyAgICAgICAgRFBL
R19ERUJfQ09NUFJFU1NPUl9MRVZFTAorICAgICksCiAgICAgIyBTZWUgZHBrZy1hcmNoaXRlY3R1
cmUoMSkuCiAgICAgcXcoCiAgICAgICAgIERQS0dfREFUQURJUgpkaWZmIC0tZ2l0IGEvc2NyaXB0
cy90L0Rwa2dfQnVpbGRJbmZvLnQgYi9zY3JpcHRzL3QvRHBrZ19CdWlsZEluZm8udAppbmRleCAw
YmRhYjYwMDMuLjQwOTMzNTEyOSAxMDA2NDQKLS0tIGEvc2NyaXB0cy90L0Rwa2dfQnVpbGRJbmZv
LnQKKysrIGIvc2NyaXB0cy90L0Rwa2dfQnVpbGRJbmZvLnQKQEAgLTE5LDUgKzE5LDUgQEAgdXNl
IFRlc3Q6Ok1vcmUgdGVzdHMgPT4gMjsKIAogdXNlIG9rICdEcGtnOjpCdWlsZEluZm8nOwogCi1p
cyhzY2FsYXIgRHBrZzo6QnVpbGRJbmZvOjpnZXRfYnVpbGRfZW52X2FsbG93ZWQoKSwgODUsCitp
cyhzY2FsYXIgRHBrZzo6QnVpbGRJbmZvOjpnZXRfYnVpbGRfZW52X2FsbG93ZWQoKSwgODcsCiAg
ICAgJ2FsbG93ZWQgZW52aXJvbm1lbnQgdmFyaWFibGVzIGFycmF5Jyk7Ci0tIAoyLjQzLjAKCg==
--000000000000f50c100654ec56ff--