From 55c4b4fad19d93c834962357558e89af2f16f718 Mon Sep 17 00:00:00 2001
From: Utkarsh Gupta <utkarsh@debian.org>
Date: Fri, 15 May 2020 23:45:54 +0530
Subject: [PATCH] Add patch to make build reproducible

---
 debian/patches/reprotest.patch | 95 ++++++++++++++++++++++++++++++++++
 debian/patches/series          |  1 +
 2 files changed, 96 insertions(+)
 create mode 100644 debian/patches/reprotest.patch

diff --git a/debian/patches/reprotest.patch b/debian/patches/reprotest.patch
new file mode 100644
index 000000000..5457f6954
--- /dev/null
+++ b/debian/patches/reprotest.patch
@@ -0,0 +1,95 @@
+From b85eefb4604d3ca6983bf80e7dc9d1cedde072fd Mon Sep 17 00:00:00 2001
+From: Patrick Steinhardt <ps@pks.im>
+Date: Fri, 15 May 2020 19:52:40 +0200
+Subject: [PATCH] cmake: Sort source files for reproducible builds
+
+We currently use `FILE(GLOB ...)` in most places to find source and
+header files. This is problematic in that the order of files returned
+depends on the operating system's directory iteration order and may thus
+not be deterministic. As a result, we link object files in unspecified
+order, which may cause the linker to emit different code across runs.
+
+Fix this issue by sorting all code used as input to the libgit2 library
+to improve the reliability of reproducible builds.
+
+--- a/cmake/Modules/SelectHashes.cmake
++++ b/cmake/Modules/SelectHashes.cmake
+@@ -66,4 +66,6 @@
+ 	MESSAGE(FATAL_ERROR "Asked for unknown SHA1 backend: ${SHA1_BACKEND}")
+ ENDIF()
+ 
++list(SORT SRC_SHA1)
++
+ ADD_FEATURE_INFO(SHA ON "using ${SHA1_BACKEND}")
+--- a/src/CMakeLists.txt
++++ b/src/CMakeLists.txt
+@@ -76,12 +76,13 @@
+ ADD_FEATURE_INFO(threadsafe THREADSAFE "threadsafe support")
+ 
+ 
+-IF (WIN32 AND EMBED_SSH_PATH)
+-	FILE(GLOB SRC_SSH "${EMBED_SSH_PATH}/src/*.c")
+-	LIST(APPEND LIBGIT2_SYSTEM_INCLUDES "${EMBED_SSH_PATH}/include")
+-	FILE(WRITE "${EMBED_SSH_PATH}/src/libssh2_config.h" "#define HAVE_WINCNG\n#define LIBSSH2_WINCNG\n#include \"../win32/libssh2_config.h\"")
+-	SET(GIT_SSH 1)
+-ENDIF()
++if(WIN32 AND EMBED_SSH_PATH)
++	file(GLOB SRC_SSH "${EMBED_SSH_PATH}/src/*.c")
++	list(SORT SRC_SSH)
++	list(APPEND LIBGIT2_SYSTEM_INCLUDES "${EMBED_SSH_PATH}/include")
++	file(WRITE "${EMBED_SSH_PATH}/src/libssh2_config.h" "#define HAVE_WINCNG\n#define LIBSSH2_WINCNG\n#include \"../win32/libssh2_config.h\"")
++	set(GIT_SSH 1)
++endif()
+ 
+ IF (WIN32 AND WINHTTP)
+ 	SET(GIT_WINHTTP 1)
+@@ -267,33 +268,38 @@
+ ADD_DEFINITIONS(-D_FILE_OFFSET_BITS=64)
+ 
+ # Collect sourcefiles
+-FILE(GLOB SRC_H
++file(GLOB SRC_H
+ 	"${libgit2_SOURCE_DIR}/include/git2.h"
+ 	"${libgit2_SOURCE_DIR}/include/git2/*.h"
+ 	"${libgit2_SOURCE_DIR}/include/git2/sys/*.h")
++list(SORT SRC_H)
+ 
+ # On Windows use specific platform sources
+-IF (WIN32 AND NOT CYGWIN)
+-	IF(MSVC)
++if (WIN32 AND NOT CYGWIN)
++	if(MSVC)
+ 		SET(WIN_RC "win32/git2.rc")
+-	ENDIF()
++	endif()
+ 
+-	FILE(GLOB SRC_OS win32/*.c win32/*.h)
+-ELSEIF (AMIGA)
+-	ADD_DEFINITIONS(-DNO_ADDRINFO -DNO_READDIR_R -DNO_MMAP)
+-ELSE()
+-	FILE(GLOB SRC_OS unix/*.c unix/*.h)
+-ENDIF()
++	file(GLOB SRC_OS win32/*.c win32/*.h)
++	list(SORT SRC_OS)
++elseif(AMIGA)
++	add_definitions(-DNO_ADDRINFO -DNO_READDIR_R -DNO_MMAP)
++else()
++	file(GLOB SRC_OS unix/*.c unix/*.h)
++	list(SORT SRC_OS)
++endif()
+ 
+ IF (USE_LEAK_CHECKER STREQUAL "valgrind")
+ 	ADD_DEFINITIONS(-DVALGRIND)
+ ENDIF()
+ 
+-FILE(GLOB SRC_GIT2 *.c *.h
++file(GLOB SRC_GIT2 *.c *.h
+ 	allocators/*.c allocators/*.h
+ 	streams/*.c streams/*.h
+ 	transports/*.c transports/*.h
+ 	xdiff/*.c xdiff/*.h)
++list(SORT SRC_GIT2)
++
+ IF(APPLE)
+ 	# The old Secure Transport API has been deprecated in macOS 10.15.
+ 	SET_SOURCE_FILES_PROPERTIES(streams/stransport.c PROPERTIES COMPILE_FLAGS -Wno-deprecated)
diff --git a/debian/patches/series b/debian/patches/series
index 08c699a18..b603fe5b3 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1 +1,2 @@
 disable-online-tests.patch
+reprotest.patch
-- 
2.39.5