[dpkg] 84/187: Dpkg::Source::Archive: Fix reproducible source package support

[Reiner Herrmann]

This is an automated email from the git hooks/post-receive script.

deki-guest pushed a commit to branch master
in repository dpkg.

commit 66a12fb8b22f13bb89dd59bf13db2fb939d3de87
Author: Guillem Jover <guillem at debian.org>
Date:   Sat Aug 20 18:44:10 2016 +0200

    Dpkg::Source::Archive: Fix reproducible source package support
    
    We should make sure the generated tarball has its filenames sorted,
    otherwise tar will use whatever order comes from the filesystem.
---
 debian/changelog               | 2 ++
 scripts/Dpkg/Source/Archive.pm | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/debian/changelog b/debian/changelog
index 273e2b0..1e0be4b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -36,6 +36,8 @@ dpkg (1.18.11) UNRELEASED; urgency=medium
     - Make the Dpkg::Substavars parse() method return the number of substvars
       parsed.
     - Add new set_field_substvars() method to Dpkg::Substvars.
+    - Fix reproducible source package support in Dpkg::Source::Archive, by
+      sorting the tar contents with --sort=name.
   * Packaging:
     - Add liblocale-gettext-perl to libdpkg-perl Recommends.
     - Wrap and document dependency relationships.
diff --git a/scripts/Dpkg/Source/Archive.pm b/scripts/Dpkg/Source/Archive.pm
index 3810f4e..bb2a40d 100644
--- a/scripts/Dpkg/Source/Archive.pm
+++ b/scripts/Dpkg/Source/Archive.pm
@@ -50,7 +50,7 @@ sub create {
     my $mtime = $opts{source_date} // $ENV{SOURCE_DATE_EPOCH} // time;
     # Call tar creation process
     $spawn_opts{delete_env} = [ 'TAR_OPTIONS' ];
-    $spawn_opts{exec} = [ 'tar', '-cf', '-', '--format=gnu',
+    $spawn_opts{exec} = [ 'tar', '-cf', '-', '--format=gnu', '--sort=name',
                           '--mtime', "\@$mtime", '--clamp-mtime', '--null',
                           '--numeric-owner', '--owner=0', '--group=0',
                           @{$opts{options}}, '-T', '-' ];

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/reproducible/dpkg.git