Notes for libranlip - reproducible builds result

Version annotated: 1.0-4.1
Identified issues:
Identifier: random_order_in_md5sums
Description order of files in md5sums (in control.tar.gz) differ from build1 to build2. This only happens in
packages not using dh_md5sums and it's easily fixed by sorting the output of "find" before
piping it to md5sum. Example:
.
cd debian/tmp && \
find * -type f ! -regex "^DEBIAN/.*" -print0 |\
LC_ALL=C sort -z | xargs -0r md5sum > DEBIAN/md5sums
Identifier: build_id_variation_requiring_further_investigation
Description ld adds a Build ID in ELF binaries used to link external debug symbols.
See https://fedoraproject.org/wiki/Releases/FeatureBuildId#Unique_build_ID for
the spec.
The default value is a SHA1 hash over the content of the binary. See
the `--build-id` option in https://sourceware.org/binutils/docs-2.25/ld/Options.html
for other behavior.
Unless a different way to compute Build IDs has been specified, different Build IDs
are the symptom of different binary content. The actual source of the
difference might not be visible because the debug symbols might have been stripped
(and they can contain filenames which can differ if the build path is different).
There is no general solution for this problem. The source of the variation must
be tracked and fixed. The issue can come from variations in order of object
members or objects themselves, different content (e.g. `__DATE__` CPP
macros or similar), or other interesting things.
 

Our notes about issues affecting packages are stored in notes.git and are targeted at packages in Debian in 'unstable/amd64' (unless they say otherwise).