Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1149140 > unrolled thread

Bug#1037272: gbrowse: reproducible builds: random value in /etc/gbrowse/ConfigData.pm

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1037272: gbrowse: reproducible builds: random value in /etc/gbrowse/ConfigData.pm Vagrant Cascadian <vagrant@reproducible-builds.org> - 2023-06-10 01:40 +0200

#1149140 — Bug#1037272: gbrowse: reproducible builds: random value in /etc/gbrowse/ConfigData.pm

[Multipart message — attachments visible in raw view] — view raw

Source: gbrowse
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: randomness
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

The OpenIDConsumerSecret in /etc/gbrowse/ConfigData.pm is a randomized value:

  https://tests.reproducible-builds.org/debian/rb-pkg/bookworm/amd64/diffoscope-results/gbrowse.html

  'OpenIDConsumerSecret'·=>·'867318970136679',
  vs.
  'OpenIDConsumerSecret'·=>·'940203427089713',

The attached patch to Build.PL fixes this by initializing the random
seed using the SOURCE_DATE_EPOCH environment variable.

If this is really a secret, all debian users using the same package will
share the same secret, so there may be some security implications!

A better approach might be to generate this value at run time or package
installation time, but I do not know enough about how gbrowse uses this
to propose a specific approach.


Unfortunately, this is not the only reproducibility issue affecting
gbrowse, but applying this patch should make it easier to troubleshoot
the remaining issues.


Thanks for maintaining gbrowse!


live well,
  vagrant

[toc] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web