Control: tags -1 pending Hi Chris,
On Wed, Aug 09, 2023 at 09:16:05AM +0100, Chris Lamb wrote: > This is because: > > a) The documentation embeded the current build date via the copyright > year and a "last updated" timestamp. The attached patch changes this > to use SOURCE_DATE_EPOCH if available. I fixed this upstream a while ago: https://github.com/tox-dev/tox/pull/2941 > b) The default value for the --hashset argument (a random integer) was > encoded into the documentation. As this value was nondeterminstic, a > fresh value is inserted into the documentation on each build. This in > turn makes the package unreproducible. The attached patch changes this > to use the Pythonic "default=None … if default is None" pattern (NB. > this is distinct from the "notset" value, which, incidentally, is > typod in the --help text.) I've been working for this for a while, and we actually resolved it with upstream just this week! See: https://github.com/tox-dev/tox/issues/2942 https://github.com/tox-dev/tox/pull/3076 The history/current status is: I uploaded 4.4.6-1 to experimental before the freeze, as it's a major release breaking reverse dependencies. I noticed the FTBR and tried to fix them upstream in the meantime. 4.4.6 is quite a bit outdated by now. Stefano Rivera is kindly helping with bringing tox 4 to sid/trixie (see #1035635 for the thread with the release team) and while doing so (understandably) opted into not updating to a new upstream version. I have a new upstream release staged locally, building reproducibly, but not interfering with the tox 4 transition (as led by Stefano). Once the transition is over, I'll upload 4.7.0 (or later) to unstable, which should resolve this reproducibility issues -- and hopefully not introduce new ones :) Thanks! Faidon
