Bug#779223: box2d: please make the build reproducible

[Markus Koschany]

On 02.03.2015 12:09, marivalen wrote:
> On 02/25/2015 08:15 PM, Markus Koschany wrote:
>> 1. doxygen should be patched and always set HTML_TIMESTAMPS = NO in
>>     Debian.
>>
> 
> Debian doxygen maintainers seem to be reluctant to deviate from upstream
> (see #778490). So I filed a bug report to upstream about changing the
> default (see https://bugzilla.gnome.org/show_bug.cgi?id=745439 )

Thank you. I think this is the correct approach for this issue.

>> 2. dh_doxygen in the doxygen package could be enhanced to parse the
>>     Doxyfile and to set HTML_TIMESTAMPS = NO
>>     This would solve the issue for all packages that use debhelper, dh
>>     and doxygen. As far as I am aware of Doxyfile is the standard
>>     configuration file for doxygen, so that this scenario is the most
>>     common one.
> 
> Doxyfile is the default configuration file name if no configuration file
> was given to doxygen. But this is less common than you think.
> 
> I ran a script across the 300 source packages which are affected by this
> issue and before compilation changed or added the HTML_TIMESTAMP
> variable to not generate timestamps. You can find the script attached.
> It turns out that only 14% of all packages become reproducible after
> this change.

300 affected source packages is quite a lot and in my opinion also a
strong indication that the issue should be fixed at the root. I don't
understand why only 14 % of all packages become reproducible when
HTML_TIMESTAMPS is set to NO but there must be a way to reliably
determine the configuration files for Doxygen and to improve the result.

> In addition, changing all files that are named Doxyfile in this way
> might also result in build failures because it is very hard to determine
> whether a file called Doxyfile is really a doxygen configuration file
> and really used for documentation generation or used for other purposes.
> For example src:doxygen uses a file called Doxyfile in its test suite.
> So any implementation like this would have to carry and maintain a
> blacklist to detect files that are named Doxyfile but should not be
> changed.
> 
> On the other hand filing patches to the remaining 14% allows maintainers
> to forward the patch to the respective upstreams and does not hide the
> problem.

I think it is unlikely that all those patches will be accepted by
upstream which means that Debian will have to keep them forever. The
problem also wouldn't be hidden if there was a feature for dh_doxygen
that could enable or disable timestamps at will in debian/rules without
the need to patch configuration files. It would be even easier to fix
this only in Doxygen instead of modifying 300 source packages via
patches...but I said that already.


>> The problem is that HTML_TIMESTAMPS = YES is the default value for
>> doxygen.
>>
>> http://www.stack.nl/~dimitri/doxygen/manual/config.html#cfg_html_timestamp
>>
>>
>> That means new packages using doxygen will almost always be affected by
>> it. Hence I suggest to file a bug report against doxygen and to discuss
>> the above mentioned solutions with its maintainers because I feel this
>> would be the technically correct approach.
> 
> The bug had been filed as I explained above, but changing the default
> would not affect box2d because it explicitly has HTML_TIMESTAMP set to YES

That is true and that is also why I think that it would be best if
Doxygen was patched to always set HTML_TIMESTAMPS = NO and to override
this value in configuration files. Just my 2 cent.

I would like to know how other maintainers think about this issue and
wait until it is clear whether this issue will be fixed in Debian's
doxygen package or not. If it turns out that the project favors the
"patch-all-affected-packages" approach, then this patch can be quickly
applied. But I still have my doubts about the efficiency of this approach.

Regards,

Markus





-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 949 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-games-devel/attachments/20150302/130c7879/attachment.sig>