On Thursday, November 20, 2025 2:56:46 PM Mountain Standard Time Johannes Schauer Marin Rodrigues wrote: > > In what way would the .dsc be different? Shouldn’t they be generated with > > identical information both times? > > maybe. But if you think it should be like that, the reproducible-builds team > and the dpkg developers have discussed this topic at length and as of today > this is not what is happening. You can try this out yourself. First create the > upstream tarball from an unpacked source package using "dpkg-source -b ." > (this is what sbuild calls as a convenience feature when you run it from an > unpacked source directory) and move the upstream tarball somewhere else. Then > run sbuild with --source to create another upstream tarball. Then compare the > two with diffoscope and you will very likely see differences. These include, > but are not limited to: > > - the root directory of the tarball will reflect the name of the directory > that your unpacked source was in. If you build from git, then your source > directory will probably not include the source version. The unpacked > source inside sbuild will. > - different versions of the compressor will produce differently compressed > files > - different version of dpkg will create different source packages > - if your packaging git contains debian/source/local-options then these > options might affect your source tarball but since that file is not being > put into the source package it will not affect the source package packed > by sbuild
Reading over this description, it sounds like in some cases, probably when working directly with git upstreams, using this option repacks the upstream source tarball. In my workflows, which are mostly based on gbp with pristine-tar (probably the most common current workflow in Debian), I can confirm that it does not repack the source tarball. Perhaps that is why I have never had any problems with using this option. I say this as someone who cares an awful lot about reproducible builds. > > > Would the $both_changes=1 option in your ~/.config/sbuild/config.pl do > > > what > > > you want? Use the patch of this MR: > > > https://salsa.debian.org/debian/sbuild/-/merge_requests/211 > > > > Yes, it looks like that patch would address all my concerns. > > Okay. > > This is yet another convenience option. As manphiz notes, dgit performs the > mergechanges step automatically. I am still of the opinion that this feature > does not belong into sbuild but into the tool which you use to upload your > package. Based on your comment, it appears that this option is not needed if using the dgit workflow, which is good to know. But I would imagine that the majority of users are not currently using dgit (perhaps that will change in the future). So, I appreciate your being willing to add this convenience option for the rest of us. -- Soren Stoutner [email protected]
signature.asc
Description: This is a digitally signed message part.
