Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1149140
| From | Vagrant Cascadian <vagrant@reproducible-builds.org> |
|---|---|
| Newsgroups | linux.debian.bugs.dist |
| Subject | Bug#1037272: gbrowse: reproducible builds: random value in /etc/gbrowse/ConfigData.pm |
| Date | 2023-06-10 01:40 +0200 |
| Message-ID | <GETS1-ePCE-5@gated-at.bofh.it> (permalink) |
| Organization | linux.* mail to news gateway |
[Multipart message — attachments visible in raw view] - view raw
Source: gbrowse Severity: normal Tags: patch User: reproducible-builds@lists.alioth.debian.org Usertags: randomness X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org The OpenIDConsumerSecret in /etc/gbrowse/ConfigData.pm is a randomized value: https://tests.reproducible-builds.org/debian/rb-pkg/bookworm/amd64/diffoscope-results/gbrowse.html 'OpenIDConsumerSecret'·=>·'867318970136679', vs. 'OpenIDConsumerSecret'·=>·'940203427089713', The attached patch to Build.PL fixes this by initializing the random seed using the SOURCE_DATE_EPOCH environment variable. If this is really a secret, all debian users using the same package will share the same secret, so there may be some security implications! A better approach might be to generate this value at run time or package installation time, but I do not know enough about how gbrowse uses this to propose a specific approach. Unfortunately, this is not the only reproducibility issue affecting gbrowse, but applying this patch should make it easier to troubleshoot the remaining issues. Thanks for maintaining gbrowse! live well, vagrant
Back to linux.debian.bugs.dist | Previous | Next | Find similar | Unroll thread
Bug#1037272: gbrowse: reproducible builds: random value in /etc/gbrowse/ConfigData.pm Vagrant Cascadian <vagrant@reproducible-builds.org> - 2023-06-10 01:40 +0200
csiph-web