bug#50015: Rust packages are not reproducible

[Efraim Flashner]

On Wed, Aug 11, 2021 at 11:15:09PM +0200, Ludovic Courtès wrote:
> Hello!
> 
> Rust packages, which are essentially empty, are not bit-reproducible:
> 
> --8<---------------cut here---------------start------------->8---
> $ ./pre-inst-env guix challenge rust-rocket-codegen 
> --substitute-urls='https://ci.guix.gnu.org https://bordeaux.guix.gnu.org' 
> /gnu/store/09hlac18bwl1kcnhdig7z1v2j8ly1czw-rust-rocket-codegen-0.4.7 
> contents differ:
>   no local build for 
> '/gnu/store/09hlac18bwl1kcnhdig7z1v2j8ly1czw-rust-rocket-codegen-0.4.7'
>   
> https://ci.guix.gnu.org/nar/lzip/09hlac18bwl1kcnhdig7z1v2j8ly1czw-rust-rocket-codegen-0.4.7:
>  0j6zf2afvc49jnp7i6z7yvbxm0bmw8yc65hz3lncgvw5lc6z1bc1
>   
> https://bordeaux.guix.gnu.org/nar/lzip/09hlac18bwl1kcnhdig7z1v2j8ly1czw-rust-rocket-codegen-0.4.7:
>  015kb637b56mqcsg3f6x1qggm2bybiszji2069gb913wxbj6rs7w
>   differing file:
>     /share/cargo/registry/rocket_codegen-0.4.7.crate
> 
> 1 store items were analyzed:
>   - 0 (0.0%) were identical
>   - 1 (100.0%) differed
>   - 0 (0.0%) were inconclusive
> ludo@ribbon ~/src/guix$ ./pre-inst-env guix challenge rust-rocket-codegen
> /gnu/store/09hlac18bwl1kcnhdig7z1v2j8ly1czw-rust-rocket-codegen-0.4.7 
> contents differ:
>   no local build for 
> '/gnu/store/09hlac18bwl1kcnhdig7z1v2j8ly1czw-rust-rocket-codegen-0.4.7'
>   
> https://ci.guix.gnu.org/nar/lzip/09hlac18bwl1kcnhdig7z1v2j8ly1czw-rust-rocket-codegen-0.4.7:
>  0j6zf2afvc49jnp7i6z7yvbxm0bmw8yc65hz3lncgvw5lc6z1bc1
>   
> https://bordeaux.guix.gnu.org/nar/lzip/09hlac18bwl1kcnhdig7z1v2j8ly1czw-rust-rocket-codegen-0.4.7:
>  015kb637b56mqcsg3f6x1qggm2bybiszji2069gb913wxbj6rs7w
>   differing file:
>     /share/cargo/registry/rocket_codegen-0.4.7.crate
> 
> 1 store items were analyzed:
>   - 0 (0.0%) were identical
>   - 1 (100.0%) differed
>   - 0 (0.0%) were inconclusive
> $ git log |head -1
> commit 973842acbc2d0dc1ab41738a534d4abda6d9efa7
> --8<---------------cut here---------------end--------------->8---
> 
> The diffoscope output suggests it’s about timestamps on one file in the
> .crate archive:
> 
> --8<---------------cut here---------------start------------->8---
> │ │ │ │   --- 
> /tmp/guix-directory.ii5wmv/share/cargo/registry/rocket_codegen-0.4.7.crate
> │ │ │ ├── +++ 
> /tmp/guix-directory.uTTKSw/share/cargo/registry/rocket_codegen-0.4.7.crate
> │ │ │ │ ├── rocket_codegen-0.4.7.crate-content
> │ │ │ │ │ ├── file list
> │ │ │ │ │ │ @@ -1,67 +1,67 @@
> │ │ │ │ │ │ --rw-r--r--   0        0        0     1293 2021-07-27 
> 15:22:18.000000 rocket_codegen-0.4.7/Cargo.toml
> […]
> │ │ │ │ │ │ +-rw-r--r--   0        0        0     1293 2021-07-27 
> 22:01:49.000000 rocket_codegen-0.4.7/Cargo.toml
> --8<---------------cut here---------------end--------------->8---
> 
> Does that ring a bell?
> 
> Thanks,
> Ludo’.
> 
> PS: I noticed this via
>     
> <http://data.guix.gnu.org/revision/973842acbc2d0dc1ab41738a534d4abda6d9efa7/package-reproducibility>
>     with help from Chris.  Fixing this could noticeably improve our
>     stats.  :-)
> 

I tried patching this a couple of ways, but it looks like the best
option is going to be a 'patch-and-repack phase after 'install. the
.crate file is really a gzip tarball, and I suspect that each time we
run 'cargo <something>' the timestamp gets updated.

-- 
Efraim Flashner   <efraim@flashner.co.il>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

signature.asc
Description: PGP signature