Package: firefox-esr Version: 45.2.0esr-1 Consider the file /usr/share/firefox-esr/browser/defaults/preferences/devtools.js
In firefox-esr amd64 45.2.0esr-1 this file has mtime 1262304000 (Fri, 01 Jan 2010 00:00:00 +0000) and md5sum e2d91069375cf952e47afa3579bf3d0e. In firefox-esr amd64 45.0.2esr-1 this file has the same mtime but md5sum a52a848fe0dbf78d4c3a44c12cfe0cee. diffing the two versions shows that the file embeds a filename on the buildd: @@ -1,13 +1,13 @@$ -//@line 5 "/tmp/buildd/firefox-esr-45.0.2esr/devtools/client/preferences/devtools.js"$ +//@line 5 "/tmp/buildd/firefox-esr-45.2.0esr/devtools/client/preferences/devtools.js"$ It is not good when a file is updated during a package update, but the mtime is not changed. This can cause backups to miss the file (because the mtime remains unchanged) and can cause integrity checks to fail. Clearly whatever substitutions proces resulted in this embedding of the filenames did not occur in 2010. I doubt that even the ultimate source for this file (and all but one of the others in the same directory) was really last edited on or before the beginning of 2010. Something must be resetting the mtime explicitly. I suggest that the best way to fix this would be to use the debian/changelog timestamp instead of what appears to be a fixed value in 2010. That would not make the build any less reproducible. FYI my own backups failed an integrity check as a result. I observed failures with three files: /usr/share/firefox-esr/browser/defaults/preferences/devtools.js /usr/share/firefox-esr/browser/defaults/preferences/firefox.js /usr/share/firefox-esr/browser/defaults/preferences/webide-prefs.js Thanks for your attention. Regards, Ian. -- Ian Jackson <ijack...@chiark.greenend.org.uk> These opinions are my own. If I emailed you from an address @fyvzl.net or @evade.org.uk, that is a private address which bypasses my fierce spamfilter.
