Building a .deb package reproducibly

Question

This comes from how to apply patch in a debian package? . Now after building the packages, I have no idea whether the packages got built correctly or not. I did see this in the parent directory -

 ┌─[shirish@debian] - [~/games] - [5870]
└─[$] cat dpkg_1.18.15+nmu1_amd64.changes

Format: 1.8
Date: Mon, 21 Nov 2016 01:04:02 +0530
Source: dpkg
Binary: dpkg libdpkg-dev dpkg-dev libdpkg-perl dselect
Architecture: source amd64 all
Version: 1.18.15+nmu1
Distribution: UNRELEASED
Urgency: medium
Maintainer: Dpkg Developers <[email protected]>
Changed-By: shirish <shirish@debian>
Description:
 dpkg       - Debian package management system
 dpkg-dev   - Debian package development tools
 dselect    - Debian package management front-end
 libdpkg-dev - Debian package management static library
 libdpkg-perl - Dpkg perl modules
Changes:
 dpkg (1.18.15+nmu1) UNRELEASED; urgency=medium
 .
   * Non-maintainer upload.
   * Apply d-m-h fix from #844701
Checksums-Sha1:
 8e50f097f70d621071e1e22384c1d68da7693929 1169 dpkg_1.18.15+nmu1.dsc
 16aa8483b0ce8d9eb1f0daebca6da84578226966 4617028 dpkg_1.18.15+nmu1.tar.xz
 3f3eae9de5bb31e178a4acb32654e68410902bda 1238392 dpkg-dbgsym_1.18.15+nmu1_amd64.deb
 3877d627c7c70bd98f16ee0b71d80c69667a6885 1581332 dpkg-dev_1.18.15+nmu1_all.deb
 b678906567a0c8ba089a5eb109855eba608f60e7 2067816 dpkg_1.18.15+nmu1_amd64.deb
 6130872887cd4eeba0b0cc0d0c7354322709dfe7 280736 dselect-dbgsym_1.18.15+nmu1_amd64.deb
 58eb460ab48e1c802ee7ae439dc0295424ef7742 1270868 dselect_1.18.15+nmu1_amd64.deb
 41e17c39ced6f55b9e72d042255a7a9b647b2e8e 1040980 libdpkg-dev_1.18.15+nmu1_amd64.deb
 a38005cde488603a7ee5de9ce7bc307c79277bb9 1242182 libdpkg-perl_1.18.15+nmu1_all.deb
Checksums-Sha256:
 2c8cf8ab1256814aa7115009a4620da913b27935351872335cd429ae4e7a9c70 1169 dpkg_1.18.15+nmu1.dsc
 47390a1ca4a296852ef3c25c0bdc82217e49738438882a980e8da28dca0d809e 4617028 dpkg_1.18.15+nmu1.tar.xz
 4a47a968b5dd4b1e87c99e5de9e3fd31b610ebb1891989de3a72ef08afb3405b 1238392 dpkg-dbgsym_1.18.15+nmu1_amd64.deb
 a05ae6dcefd5bc9affe355c8dd4106b42f795678fa4de31bc063a9784fc845ab 1581332 dpkg-dev_1.18.15+nmu1_all.deb
 b9682da9975541f385b47cf1148028deea4a48a51156293589b124c6f706d7b7 2067816 dpkg_1.18.15+nmu1_amd64.deb
 d75479bb9005788d96e839ae8b2dde56701993ac6421df1f5aaf79634f008a48 280736 dselect-dbgsym_1.18.15+nmu1_amd64.deb
 8b317f45808d408485c566b9748522d63d556bcec7525dcaa442a9720073dd27 1270868 dselect_1.18.15+nmu1_amd64.deb
 e45e67c3ab034ed3d1bf9f268daba92ee3cc406c3b75ef2bd0354ec79dc30d7f 1040980 libdpkg-dev_1.18.15+nmu1_amd64.deb
 d75ff545c612a7eb5f4563bb3619cd33ea4d4baff6cade9452e94bb1e7b7a412 1242182 libdpkg-perl_1.18.15+nmu1_all.deb
Files:
 faab0ae6b71c8216a634cbef6759d122 1169 admin required dpkg_1.18.15+nmu1.dsc
 69eeaa680e11f291860217a9536e93dc 4617028 admin required dpkg_1.18.15+nmu1.tar.xz
 91961eae15e20a3bf2ad614cf42ee4ab 1238392 debug extra dpkg-dbgsym_1.18.15+nmu1_amd64.deb
 aa361b4cde6020393c75a601c51f54e6 1581332 utils optional dpkg-dev_1.18.15+nmu1_all.deb
 325a9629e03781c027f884a17ada0550 2067816 admin required dpkg_1.18.15+nmu1_amd64.deb
 75dbcd90ada67522d79206b65519865e 280736 debug extra dselect-dbgsym_1.18.15+nmu1_amd64.deb
 e490b38b2b132c26670635628e302941 1270868 admin optional dselect_1.18.15+nmu1_amd64.deb
 0d206c14b1ffd5cb6b09608e9774b3bf 1040980 libdevel optional libdpkg-dev_1.18.15+nmu1_amd64.deb
 e22e289a709d36d2186da60e07b68225 1242182 perl optional libdpkg-perl_1.18.15+nmu1_all.deb

I also saw a build-tree in the same directory and from the time-stamps the build-tree must have generated during the last step only .

$dpkg-buildpackage -us -uc

Now the checksums that are provided, these should be canonical (meaning same). At least from what little I understand that is the claim of reproducible builds. . I want that me and the maintainer should be able to check the integrity of the packages built . I looked at the manpage of dpkg-buildpackage and tried searching for 'reproducible' keyword but didn't find it there.

Answer 1

The maintainer has only asked you to check whether the supplied patch fixes things. If dpkg with the patch allows you to install libconfig-model-perl without the errors you were getting before, that would suggest that the patch fixes the issue. If it doesn't, the patch also includes more verbose output which should help pinpoint the real issue. That's all that's needed — there's no need to worry about reproducible builds.

Since you have a .changes file, your build completed successfully; and since dpkg includes an extensive test suite, you can be confident that it built correctly.

In any case, building a package reproducibly currently requires a modified toolchain, and reproducible builds answer a very specific question: "given an identical build environment, can I build a package identically to some reference?". It's unlikely that the maintainer and you have an identical build environment.

The checksums in the .changes file aren't canonical in a reproducible sense. They're present for two reasons:

• to verify that a package uploaded to the archive was uploaded correctly;
• to verify that a package uploaded to the archive matches what was signed by the uploader (this is part of the "chain of integrity" of Debian packages).

Successive rebuilds of the same source are currently expected to result in different checksums.