#73613 texlive packages such as texlive-luatex are not reproducible

Message #5 received at submit@debbugs.gnu.org (full text, mbox, reply):

From: Maxim Cournoyer <maxim.cournoyer@gmail.com>

To: bug-guix <bug-guix@gnu.org>

Subject: texlive-luatex is not reproducible

Date: Thu, 03 Oct 2024 21:19:17 +0900

Hello,

This was discovered building texlive-luatex twice (--rounds=2 -K);
diffoscope shows that:

--8<---------------cut here---------------start------------->8---
│ │ │ │ ├── +++ /gnu/store/jyfqmfrhg3m0njdy8yi0qrgqfilaldf2-texlive-luatex-2024.2-check/share/texmf-dist/web2c/luatex/dviluatex.fmt
│ │ │ │ │ ├── dviluatex.fmt-content
│ │ │ │ │ │┄ xxd not available in path. Falling back to Python hexlify.
│ │ │ │ │ │ @@ -231852,20 +231852,20 @@
│ │ │ │ │ │  3373796c203174696d20327431696e203174696f203574697120746934752072
│ │ │ │ │ │  733565722e2031746976206d65347461206c75737334203174697a206d653174
│ │ │ │ │ │  65206d34657472207561356e612074356c612075616e3469206c3576656e2075
│ │ │ │ │ │  74696f6e3561206c35766574342074356c6f20746d653420747261336220746f
│ │ │ │ │ │  33622032746f6620747261733420756172326420746f7332206572346e697320
│ │ │ │ │ │  7561723369203465726e6974203565726e697a20756172337420346669636174
│ │ │ │ │ │  6520347561622075616334203174726120753161742075623465207561763420
│ │ │ │ │ │ -75316234692000000000aa206f626c69672d612d746f7279206465632d6c692d
│ │ │ │ │ │ -6e612d74696f6e2061732d736f2d6369617465732061732d736f2d6369617465
│ │ │ │ │ │ -20726563692d70726f636974792072652d636f672d6e692d7a616e6365207265
│ │ │ │ │ │ -742d72692d62752d74696f6e207265662d6f722d6d612d74696f6e2070726f6a
│ │ │ │ │ │ -656374732074612d626c652070726573656e7473207068696c2d616e2d746872
│ │ │ │ │ │ -6f7069632070726f6a6563742070726573656e74000000000100000001000000
│ │ │ │ │ │ +75316234692000000000aa2070726573656e74732074612d626c652070726573
│ │ │ │ │ │ +656e74206465632d6c692d6e612d74696f6e2070726f6a6563742061732d736f
│ │ │ │ │ │ +2d636961746573207265662d6f722d6d612d74696f6e207265742d72692d6275
│ │ │ │ │ │ +2d74696f6e2072652d636f672d6e692d7a616e63652061732d736f2d63696174
│ │ │ │ │ │ +6520726563692d70726f63697479206f626c69672d612d746f72792070726f6a
│ │ │ │ │ │ +65637473207068696c2d616e2d7468726f706963000000000100000001000000
│ │ │ │ │ │  2d000000000000000000000000ffffffff00041d8d7562326c20327472656220
│ │ │ │ │ │  32747265632032743372656420327433726567206d65733473616c2075633163
│ │ │ │ │ │  20327433726568206d65733473616e2032743372656b2032743372656c202e66
│ │ │ │ │ │  6cc3b636733573656e2e20753163692074327279206d65733473617520753163
│ │ │ │ │ │  6c20757333c3a47320756175327320676133756e74206d657334736179207472
│ │ │ │ │ │  3465327520753364326120327433726576206e7433c3a46e64206e653473616c
│ │ │ │ │ │  20753163722074327333733220747265337820747374322032743372657a202e
│ │ │ │ │ │ @@ -268094,99 +268094,99 @@
│ │ │ │ │ │  2033746f2e2074336c612074336c692068696537726f6e792074336c6f206161
│ │ │ │ │ │  74367374692069653673377461616c207661346b6573206d616e366e2d70206e
│ │ │ │ │ │  7661366c697320c3af6e35756e642073356b616b7420347472616620616c6937
│ │ │ │ │ │  676c617320753462336167203473356b616c662033746f672075626173342074
│ │ │ │ │ │  7261743420746f3173207661356b69652065336b616e2061726b366c6f73202e
│ │ │ │ │ │  7369377261672e2065657273376c616d2034736b61722e202e7a653575732034
│ │ │ │ │ │  736b616e742061723664356167742075623366206e6534726f73200000000a9b
│ │ │ │ │ │ -20706161726c2d6f6f7320646575722d737765722d776520706f652d746f652d
│ │ │ │ │ │ -706170207672652d6465732d656e2d67656c206f6d2d6d652d7377616169206f
│ │ │ │ │ │ -2d72612d676965206c616e672d7465722d6d796e2d696d2d70616b20696e2d74
│ │ │ │ │ │ -77792d66656c2d7472656b2d6b696e672076616c2d726565702d6c6565722067
│ │ │ │ │ │ -652d626564732d6b65742d74696e6720626161642d6a69652d6d6f752d652064
│ │ │ │ │ │ -72756b2d6b65722d666f6e7473206c696d662d776565662d73656c206b616d2d
│ │ │ │ │ │ -7374692d676520737472652d706965732d6665722d7765656c2064692d612d6c
│ │ │ │ │ │ -656b2d776f6f722d64652d626f656b20747769732d61702d70656c206d61616e
[...]
--8<---------------cut here---------------end--------------->8---

These are apparently time stamps as well as UUIDs.  Debian [0, 1] and
NixOS [1] have patched some of them using faketime and substitute [0].

We should follow suite.

[0]  https://salsa.debian.org/live-team/live-build/-/blob/master/examples/hooks/reproducible/2006-reproducible-texlive-binaries-fmt-files.hook.chroot
[1]  https://github.com/NixOS/nixpkgs/pull/227873

-- 
Thanks,
Maxim

Message #14 received at 73613@debbugs.gnu.org (full text, mbox, reply):

From: Nicolas Goaziou <mail@nicolasgoaziou.fr>

To: Maxim Cournoyer <maxim.cournoyer@gmail.com>

Cc: 73613@debbugs.gnu.org

Subject: Re: bug#73613: texlive-luatex is not reproducible

Date: Sun, 20 Oct 2024 10:40:45 +0200

Hello,

Maxim Cournoyer <maxim.cournoyer@gmail.com> writes:

> This was discovered building texlive-luatex twice (--rounds=2 -K);
> diffoscope shows that:
>

[...]

> These are apparently time stamps as well as UUIDs.  Debian [0, 1] and
> NixOS [1] have patched some of them using faketime and substitute [0].
>
> We should follow suite.
>
> [0]  https://salsa.debian.org/live-team/live-build/-/blob/master/examples/hooks/reproducible/2006-reproducible-texlive-binaries-fmt-files.hook.chroot
> [1]  https://github.com/NixOS/nixpkgs/pull/227873

This is difficult to follow, because Debian and NixOS do not seem to
apply the same fixes. For example, the former wraps "faketime" around
"tex -ini tex.ini" call whereas the latter wraps it around
"fmtutil-sys --all" call.

By the way, how do you call "faketime" from (guix build-system texlive)?
It is not possible to use (gnu packages check) module from there, isn't
it?

Note that Guix never runs "mtxrun --generate", so I don't think UUIDs
are a problem in our case.

Regards,
-- 
Nicolas Goaziou

Message #17 received at 73613@debbugs.gnu.org (full text, mbox, reply):

From: Maxim Cournoyer <maxim.cournoyer@gmail.com>

To: Nicolas Goaziou <mail@nicolasgoaziou.fr>

Cc: 73613@debbugs.gnu.org

Subject: Re: bug#73613: texlive-luatex is not reproducible

Date: Sun, 15 Dec 2024 00:06:04 +0900

Hi Nicolas,

Nicolas Goaziou <mail@nicolasgoaziou.fr> writes:

> Hello,
>
> Maxim Cournoyer <maxim.cournoyer@gmail.com> writes:
>
>> This was discovered building texlive-luatex twice (--rounds=2 -K);
>> diffoscope shows that:
>>
>
> [...]
>
>> These are apparently time stamps as well as UUIDs.  Debian [0, 1] and
>> NixOS [1] have patched some of them using faketime and substitute [0].
>>
>> We should follow suite.
>>
>> [0]  https://salsa.debian.org/live-team/live-build/-/blob/master/examples/hooks/reproducible/2006-reproducible-texlive-binaries-fmt-files.hook.chroot
>> [1]  https://github.com/NixOS/nixpkgs/pull/227873
>
> This is difficult to follow, because Debian and NixOS do not seem to
> apply the same fixes. For example, the former wraps "faketime" around
> "tex -ini tex.ini" call whereas the latter wraps it around
> "fmtutil-sys --all" call.
>
> By the way, how do you call "faketime" from (guix build-system texlive)?
> It is not possible to use (gnu packages check) module from there, isn't
> it?

You'd have to add it to the implicit inputs defined for the build
system.

> Note that Guix never runs "mtxrun --generate", so I don't think UUIDs
> are a problem in our case.

OK.  I'm afraid don't have more insights than what I had shared already
:-).

-- 
Thanks,
Maxim

Send a report that this bug log contains spam.