Notes for mono - reproducible builds result

Version annotated: 4.2.1.102+dfsg2-5
Identified issues:
Identifier: captures_build_path
Description Captures build path, e.g., /build/1st/foo-42.0 v. /build/foo-42.0/2nd
.
Until early 2024 we varied the build path when testing packages from unstable
and experimental, which we have stopped doing now as the build path is recorded
as part of the environment and thus can be used when rebuilding.
.
This issue is kept here for the time being.
.
This issue is only for miscellaneous issues which need individual fixes,
please create new issues for specific issues, e.g. gcc_captures_build_path.
.
Here follows some general tips for packages using the standard GNU toolchain:
.
If using autoconf, make sure you call ./configure via a relative and not absolute path.
.
If your issue is related to using the `__FILE__` macro, or the recording of
--debug-prefix-map flags in non-GCC non-debugging output, this is what is
fixed by our patch mentioned above; you should not need to fix it
specifically in your package.
.
For more background information see:
.
• https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20160822/006788.html
• https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20160905/006984.html
• https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20160912/007076.html
Identifier: timestamps_in_pe_binaries
URL https://wiki.debian.org/ReproducibleBuilds/TimestampsInPEBinaries
Description PE binaries contain a timestamp and maybe randomness in an UUID.
Identifier: timestamps_in_zip
URL https://wiki.debian.org/ReproducibleBuilds/TimestampsInZip
Description Zip archives stores mtimes. Most often of files generated during
the build.
Identifier: timestamps_in_tarball
URL https://wiki.debian.org/ReproducibleBuilds/TimestampsInTarball
Description Tarballs capture build time in mtime of its members.
Identifier: users_and_groups_in_tarball
URL https://wiki.debian.org/ReproducibleBuilds/UsersAndGroupsInTarballs
Description Tarballs capture user and group for each of its members.
Identifier: diffoscope_runs_forever
URL https://reproducible.debian.net/index_breakages.html
Description Some packages cannot be analysed by diffoscope due to it running "forever".
Currently the diffoscope process is killed after 120 minutes.
https://reproducible.debian.net/index_breakages.html collects a list of currently
undiffable packages (as well as other issues with tests.reproducile-builds.org.
Identifier: blacklisted_on_jenkins
Description Some packages have been blacklisted in our test infrastructure because
their build hangs, takes too long, spawns processes that are not killed, or
simply because they use too many resources for our current capacity. (This
is purely practical step - we would like to test these packages.)
Bugs noted: 961942+: "mono: mono-source: Embeds time, user, group, etc. in mono-source.tar.xz"
Comments: PE timestamps are fixed, documentation tool is using timestamps.
See https://bugzilla.xamarin.com/show_bug.cgi?id=37367
timestamp, user and uid captured in mono-src.tar.*
timestamp embedded in binaries
build path also captured in mono-src.tar.* when top-level build
directory varies.
 

Our notes about issues affecting packages are stored in notes.git and are targeted at packages in Debian in 'unstable/amd64' (unless they say otherwise).