Add patch to make build reproducible

diff --git a/debian/patches/reprotest.patch b/debian/patches/reprotest.patch
new file mode 100644 (file)
index 0000000..5457f69
--- /dev/null
+++ b/debian/patches/reprotest.patch
@@ -0,0 +1,95 @@
+From b85eefb4604d3ca6983bf80e7dc9d1cedde072fd Mon Sep 17 00:00:00 2001
+From: Patrick Steinhardt <ps@pks.im>
+Date: Fri, 15 May 2020 19:52:40 +0200
+Subject: [PATCH] cmake: Sort source files for reproducible builds
+
+We currently use `FILE(GLOB ...)` in most places to find source and
+header files. This is problematic in that the order of files returned
+depends on the operating system's directory iteration order and may thus
+not be deterministic. As a result, we link object files in unspecified
+order, which may cause the linker to emit different code across runs.
+
+Fix this issue by sorting all code used as input to the libgit2 library
+to improve the reliability of reproducible builds.
+
+--- a/cmake/Modules/SelectHashes.cmake
++++ b/cmake/Modules/SelectHashes.cmake
+@@ -66,4 +66,6 @@
+       MESSAGE(FATAL_ERROR "Asked for unknown SHA1 backend: ${SHA1_BACKEND}")
+ ENDIF()
+ 
++list(SORT SRC_SHA1)
++
+ ADD_FEATURE_INFO(SHA ON "using ${SHA1_BACKEND}")
+--- a/src/CMakeLists.txt
++++ b/src/CMakeLists.txt
+@@ -76,12 +76,13 @@
+ ADD_FEATURE_INFO(threadsafe THREADSAFE "threadsafe support")
+ 
+ 
+-IF (WIN32 AND EMBED_SSH_PATH)
+-      FILE(GLOB SRC_SSH "${EMBED_SSH_PATH}/src/*.c")
+-      LIST(APPEND LIBGIT2_SYSTEM_INCLUDES "${EMBED_SSH_PATH}/include")
+-      FILE(WRITE "${EMBED_SSH_PATH}/src/libssh2_config.h" "#define HAVE_WINCNG\n#define LIBSSH2_WINCNG\n#include \"../win32/libssh2_config.h\"")
+-      SET(GIT_SSH 1)
+-ENDIF()
++if(WIN32 AND EMBED_SSH_PATH)
++      file(GLOB SRC_SSH "${EMBED_SSH_PATH}/src/*.c")
++      list(SORT SRC_SSH)
++      list(APPEND LIBGIT2_SYSTEM_INCLUDES "${EMBED_SSH_PATH}/include")
++      file(WRITE "${EMBED_SSH_PATH}/src/libssh2_config.h" "#define HAVE_WINCNG\n#define LIBSSH2_WINCNG\n#include \"../win32/libssh2_config.h\"")
++      set(GIT_SSH 1)
++endif()
+ 
+ IF (WIN32 AND WINHTTP)
+       SET(GIT_WINHTTP 1)
+@@ -267,33 +268,38 @@
+ ADD_DEFINITIONS(-D_FILE_OFFSET_BITS=64)
+ 
+ # Collect sourcefiles
+-FILE(GLOB SRC_H
++file(GLOB SRC_H
+       "${libgit2_SOURCE_DIR}/include/git2.h"
+       "${libgit2_SOURCE_DIR}/include/git2/*.h"
+       "${libgit2_SOURCE_DIR}/include/git2/sys/*.h")
++list(SORT SRC_H)
+ 
+ # On Windows use specific platform sources
+-IF (WIN32 AND NOT CYGWIN)
+-      IF(MSVC)
++if (WIN32 AND NOT CYGWIN)
++      if(MSVC)
+               SET(WIN_RC "win32/git2.rc")
+-      ENDIF()
++      endif()
+ 
+-      FILE(GLOB SRC_OS win32/*.c win32/*.h)
+-ELSEIF (AMIGA)
+-      ADD_DEFINITIONS(-DNO_ADDRINFO -DNO_READDIR_R -DNO_MMAP)
+-ELSE()
+-      FILE(GLOB SRC_OS unix/*.c unix/*.h)
+-ENDIF()
++      file(GLOB SRC_OS win32/*.c win32/*.h)
++      list(SORT SRC_OS)
++elseif(AMIGA)
++      add_definitions(-DNO_ADDRINFO -DNO_READDIR_R -DNO_MMAP)
++else()
++      file(GLOB SRC_OS unix/*.c unix/*.h)
++      list(SORT SRC_OS)
++endif()
+ 
+ IF (USE_LEAK_CHECKER STREQUAL "valgrind")
+       ADD_DEFINITIONS(-DVALGRIND)
+ ENDIF()
+ 
+-FILE(GLOB SRC_GIT2 *.c *.h
++file(GLOB SRC_GIT2 *.c *.h
+       allocators/*.c allocators/*.h
+       streams/*.c streams/*.h
+       transports/*.c transports/*.h
+       xdiff/*.c xdiff/*.h)
++list(SORT SRC_GIT2)
++
+ IF(APPLE)
+       # The old Secure Transport API has been deprecated in macOS 10.15.
+       SET_SOURCE_FILES_PROPERTIES(streams/stransport.c PROPERTIES COMPILE_FLAGS -Wno-deprecated)

diff --git a/debian/patches/series b/debian/patches/series
index 08c699a18c7019aacf546f1d210afcc92408ad31..b603fe5b30a704b4164afdc545c695135451406b 100644 (file)
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1 +1,2 @@
 disable-online-tests.patch
+reprotest.patch