Issue 8928 - Reproducibility: Remove user, hostname, pwd from version string
Summary: Reproducibility: Remove user, hostname, pwd from version string
Status: VERIFIED FIXED
Alias: None
Product: OpenLDAP
Classification: Unclassified
Component: build (show other issues)
Version: unspecified
Hardware: All All
: --- normal
Target Milestone: ---
Assignee: OpenLDAP project
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-10-18 00:49 UTC by douglas.royds@taitradio.com
Modified: 2018-12-19 17:19 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this issue.
Description douglas.royds@taitradio.com 2018-10-18 00:49:52 UTC
Full_Name: Douglas Royds
Version: HEAD
OS: Ubuntu 16.04
URL: ftp://ftp.openldap.org/incoming/douglas-royds-181017.patch
Submission from: (NULL) (202.37.96.2)


To achieve binary-reproducible builds across different build hosts, build paths,
and users, we need to set the WHOWHERE value with something fixed. In this patch
I set it to the SOURCE_DATE_EPOCH if set (see
https://reproducible-builds.org/specs/source-date-epoch/). If you're not trying
to do a reproducible build, it won't be set, so the existing WHOWHERE string
will apply.

Debian have set this string to their own Debian-specific value:

    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833179

    WHOWHERE="$(dpkg-vendor --query vendor) package version
$(dpkg-parsechangelog -SVersion)"

Tait Communications Ltd hereby place the following modifications to OpenLDAP
Software (and only these modifications) into the public domain. Hence, these
modifications may be freely used and/or redistributed for any purpose with or
without attribution and/or other notice. 
Comment 1 douglas.royds@taitradio.com 2018-10-25 23:42:03 UTC
URL: ftp://ftp.openldap.org/incoming/douglas-royds-181026.patch

This updated patch also sets the date and time strings to the 
SOURCE_DATE_EPOCH.

The WHOWHERE string will now be set to simply "openldap" in the case 
that a SOURCE_DATE_EPOCH is set.

Tait Communications Ltd hereby place the following modifications to 
OpenLDAP Software (and only these modifications) into the public domain. 
Hence, these modifications may be freely used and/or redistributed for 
any purpose with or without attribution and/or other notice.


Comment 2 Quanah Gibson-Mount 2018-11-16 19:37:24 UTC
changed notes
Comment 3 Quanah Gibson-Mount 2018-11-16 19:37:54 UTC
changed notes
Comment 4 Howard Chu 2018-11-16 22:42:21 UTC
douglas.royds@taitradio.com wrote:
> URL: ftp://ftp.openldap.org/incoming/douglas-royds-181026.patch
> 
> This updated patch also sets the date and time strings to the 
> SOURCE_DATE_EPOCH.

Are you intending a SOURCE_DATE_EPOCH to be a Unix time value? I.e., an integer?
This value format needs to be documented.

Unfortunately, your use of date -d is nonportable, it appears that only the GNU tools
understand this option. It will fail on other platforms like *BSD, Solaris, that aren't
using a GNU userland.

Why can't you simply provide an already formatted date & time that can be used
directly, instead of needing to be reformatted here?

> The WHOWHERE string will now be set to simply "openldap" in the case 
> that a SOURCE_DATE_EPOCH is set.
> 
> Tait Communications Ltd hereby place the following modifications to 
> OpenLDAP Software (and only these modifications) into the public domain. 
> Hence, these modifications may be freely used and/or redistributed for 
> any purpose with or without attribution and/or other notice.
> 
> 
> 
> 
> 


-- 
  -- Howard Chu
  CTO, Symas Corp.           http://www.symas.com
  Director, Highland Sun     http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP  http://www.openldap.org/project/

Comment 5 douglas.royds@taitradio.com 2018-11-18 23:20:04 UTC
On 17/11/18 11:42 AM, Howard Chu wrote:

> douglas.royds@taitradio.com wrote:
>> URL: ftp://ftp.openldap.org/incoming/douglas-royds-181026.patch
>>
>> This updated patch also sets the date and time strings to the
>> SOURCE_DATE_EPOCH.
> Are you intending a SOURCE_DATE_EPOCH to be a Unix time value? I.e., an integer?
> This value format needs to be documented.
>
> Unfortunately, your use of date -d is nonportable, it appears that only the GNU tools
> understand this option. It will fail on other platforms like *BSD, Solaris, that aren't
> using a GNU userland.
>
> Why can't you simply provide an already formatted date & time that can be used
> directly, instead of needing to be reformatted here?


URL: ftp://ftp.openldap.org/incoming/douglas-royds-181119.patch

Good point about BSD, my mistake. I have modified the patch to support 
BSD platforms as well, though I don't have access to a BSD platform to 
test it.

I have added a code comment with a link to the SOURCE_DATE_EPOCH 
specification: https://reproducible-builds.org/specs/source-date-epoch/

A more human-readable description and tips for its use can be found 
here: https://reproducible-builds.org/docs/source-date-epoch/


Comment 6 Howard Chu 2018-11-18 23:34:26 UTC
douglas.royds@taitradio.com wrote:
> On 17/11/18 11:42 AM, Howard Chu wrote:
> 
>> douglas.royds@taitradio.com wrote:
>>> URL: ftp://ftp.openldap.org/incoming/douglas-royds-181026.patch
>>>
>>> This updated patch also sets the date and time strings to the
>>> SOURCE_DATE_EPOCH.
>> Are you intending a SOURCE_DATE_EPOCH to be a Unix time value? I.e., an integer?
>> This value format needs to be documented.
>>
>> Unfortunately, your use of date -d is nonportable, it appears that only the GNU tools
>> understand this option. It will fail on other platforms like *BSD, Solaris, that aren't
>> using a GNU userland.
>>
>> Why can't you simply provide an already formatted date & time that can be used
>> directly, instead of needing to be reformatted here?
> 
> 
> URL: ftp://ftp.openldap.org/incoming/douglas-royds-181119.patch
> 
> Good point about BSD, my mistake. I have modified the patch to support 
> BSD platforms as well, though I don't have access to a BSD platform to 
> test it.
> 
> I have added a code comment with a link to the SOURCE_DATE_EPOCH 
> specification: https://reproducible-builds.org/specs/source-date-epoch/
> 
> A more human-readable description and tips for its use can be found 
> here: https://reproducible-builds.org/docs/source-date-epoch/

Thanks. According to this link, we shouldn't even need the date/time portion
of this patch.

Under the section "Reading the Variable" we have
> gcc (>= 7, Debian >= 5.3.1-17, Debian >= 6.1.1-1)
https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=e3e8c48c4a494d9da741c1c8ea6c4c0b7c4ff934

I.e., gcc itself will set __DATE__ and __TIME__ accordingly if SOURCE_DATE_EPOCH is set.

I'm inclined to just tweak WHOWHERE and let gcc handle the rest.

-- 
  -- Howard Chu
  CTO, Symas Corp.           http://www.symas.com
  Director, Highland Sun     http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP  http://www.openldap.org/project/

Comment 7 douglas.royds@taitradio.com 2018-11-19 00:10:14 UTC
URL: ftp://ftp.openldap.org/incoming/douglas-royds-181120.patch


On 19/11/18 12:34 PM, Howard Chu wrote:

> Thanks. According to this link, we shouldn't even need the date/time portion
> of this patch.
>
> Under the section "Reading the Variable" we have
>> gcc (>= 7, Debian >= 5.3.1-17, Debian >= 6.1.1-1)
> https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=e3e8c48c4a494d9da741c1c8ea6c4c0b7c4ff934
>
> I.e., gcc itself will set __DATE__ and __TIME__ accordingly if SOURCE_DATE_EPOCH is set.
>
> I'm inclined to just tweak WHOWHERE and let gcc handle the rest.


Once again, good point. I have removed the date and time changes from 
the patch, and only kept the WHOWHERE change, still using the existence 
of a SOURCE_DATE_EPOCH to decide whether to fix the string or not.


Comment 8 Howard Chu 2018-11-19 00:40:56 UTC
douglas.royds@taitradio.com wrote:
> URL: ftp://ftp.openldap.org/incoming/douglas-royds-181120.patch
> 
> 
> On 19/11/18 12:34 PM, Howard Chu wrote:
> 
>> Thanks. According to this link, we shouldn't even need the date/time portion
>> of this patch.
>>
>> Under the section "Reading the Variable" we have
>>> gcc (>= 7, Debian >= 5.3.1-17, Debian >= 6.1.1-1)
>> https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=e3e8c48c4a494d9da741c1c8ea6c4c0b7c4ff934
>>
>> I.e., gcc itself will set __DATE__ and __TIME__ accordingly if SOURCE_DATE_EPOCH is set.
>>
>> I'm inclined to just tweak WHOWHERE and let gcc handle the rest.
> 
> 
> Once again, good point. I have removed the date and time changes from 
> the patch, and only kept the WHOWHERE change, still using the existence 
> of a SOURCE_DATE_EPOCH to decide whether to fix the string or not.
> 

Thanks. Added to master.

-- 
  -- Howard Chu
  CTO, Symas Corp.           http://www.symas.com
  Director, Highland Sun     http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP  http://www.openldap.org/project/

Comment 9 Howard Chu 2018-11-19 00:41:49 UTC
changed notes
changed state Open to Test
moved from Incoming to Build
Comment 10 Quanah Gibson-Mount 2018-11-19 16:22:16 UTC
changed notes
changed state Test to Release
Comment 11 OpenLDAP project 2018-12-19 17:19:46 UTC
in master
Added to RE24 (2.4.47)
Comment 12 Quanah Gibson-Mount 2018-12-19 17:19:46 UTC
changed notes
changed state Release to Closed